Windows Server 2019
Monthly
Local privilege escalation in the Windows Storage Spaces Controller lets an authenticated low-privileged user corrupt kernel heap memory and gain execution at SYSTEM level, because the component fails to bounds-check attacker-influenced data (CVSS 7.8, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The affected surface is the Storage Spaces Controller present by default across Windows 10, Windows 11 and Windows Server 2012/2012 R2/2016/2019/2022/2025, including Server Core installations; patched builds (for example Windows 11 24H2 10.0.26100.9711, Windows Server 2025 10.0.26100.33650) are not exploitable. Exploitation is confined to a post-compromise scenario requiring an existing local foothold or valid low-privileged credentials, and no public exploit code has been identified at time of analysis; CISA's SSVC assessment records exploitation as 'none' and automatable exploitation as 'no', and the independent assessment rates this as credible but not emergency-priority.
Local privilege escalation in Microsoft's Windows Ancillary Function Driver for WinSock (afd.sys) lets an authenticated attacker who already has code execution on a target machine trigger a use-after-free in the kernel socket-handling paths and elevate to SYSTEM. The flaw is rated CVSS 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) - it is strictly local and requires a pre-existing foothold, and the race/timing nature of the bug makes it hard to trigger reliably, which is why CISA's SSVC rates exploitation as 'none' and automatable as 'no'. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so the risk is assessed as moderate rather than emergency priority; Microsoft has released fixes, with EUVD tracking the affected builds under EUVD-2026-99879.
Local privilege escalation in the Windows Win32 Kernel Subsystem lets an attacker who already holds authenticated, low-privileged access on a host trigger a use-after-free in kernel memory and gain elevated (SYSTEM-level) code execution. The assessed vector (AV:L/AC:H/PR:L/UI:N) shows exploitation is confined to the local machine and is gated by high attack complexity - the memory-reclamation or race timing makes reliable exploitation difficult and non-deterministic - with no user interaction and no remote or unauthenticated path. Microsoft has released vendor patches for every affected Windows 10/11 and Windows Server build, and no public exploit code or confirmed active exploitation has been identified at time of analysis (CISA KEV not listed; SSVC exploitation: none, automatable: no).
Local privilege escalation in the Windows Common Log File System (CLFS) driver lets an authenticated attacker who already holds low-privileged code execution on a Windows host trigger a heap-based buffer overflow in kernel mode and elevate to SYSTEM. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning no user interaction is required and attack complexity is low once a foothold exists, but it is not remotely reachable and cannot be triggered by luring a victim to open content. A vendor patch is available from Microsoft (per the MSRC update guide) and no public exploit code or confirmed active exploitation was identified at time of analysis, so this is a high-priority patch target for organizations that cannot fully prevent local code execution on endpoints and servers.
Local privilege escalation in the Windows Audio Service (audiosrv) lets an authenticated, low-privileged attacker who already has code execution on a Windows host corrupt memory and elevate to a higher-integrity context. The flaw is a use-after-free (CWE-416) rated CVSS 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H); the high attack-complexity value indicates the trigger likely depends on a race or a specific allocation/free timing window, making it unreliably repeatable rather than a one-shot exploit. Microsoft has published fixes through its update guide, and no public exploit code has been identified at time of analysis; the CVE was not listed in CISA KEV as of this assessment, so there is no confirmation of active exploitation.
Remote code execution against domain controllers running Active Directory Domain Services is achievable by an unauthenticated network attacker (CVSS 3.1: AV:N/PR:N/UI:N) who successfully bypasses an incorrect authorization check, yielding full confidentiality, integrity, and availability impact for a base score of 8.1. The practical constraint is the High attack-complexity rating: exploiting the flawed authorization decision requires an attacker-influenced condition such as a timing window, race, or particular directory state rather than a single deterministic request against a default configuration, and only hosts serving the AD DS role - not member servers or ordinary clients - are the realistic target. At time of analysis no public exploit identified and no confirmed active exploitation (no CISA KEV listing); vendor patch available, with EUVD-listed fixed build levels published.
Local privilege escalation in the Windows Desktop Window Manager (dwm.exe) allows an attacker who already holds an authenticated low-privilege account on the target host to exploit an out-of-bounds read and gain elevated (SYSTEM-level) code execution. All supported Windows 10, Windows 11, and Windows Server 2019/2022/2025 editions are affected up to their respective fixed builds, and the prerequisite is purely local code execution with no user interaction (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8). No public exploit code or confirmed active exploitation has been identified at the time of analysis and CISA SSVC rates exploitation as none and not automatable, so this is a routine patch-priority item rather than an emergency - but the vendor update should be applied promptly on multi-user, RDP-accessible, and privileged-administration endpoints where a local foothold is easiest to obtain.
Local privilege escalation in Microsoft's Windows Ancillary Function Driver for WinSock (AFD.sys) lets an attacker who already has low-privileged local code execution on a host obtain elevated (SYSTEM) rights by triggering a type confusion in the kernel driver. The flaw carries CVSS 7.8 (AV:L/AC:L/PR:L/UI:N), meaning the attack is local-only, needs valid low-level credentials or prior code execution, and requires no user interaction; AFD.sys is loaded by default on every supported Windows edition, so no non-default configuration is needed to reach the vulnerable code. It affects a broad set of Windows 10/11 and Windows Server 2012-2025 builds below the patched levels in EUVD-2026-99199; no public exploit identified at time of analysis, and CISA's SSVC assessment records exploitation as none with automatable set to no. This is a genuine patch-priority item but not an emergency.
Local privilege escalation in the Windows Console Driver (conhost/console driver component) allows an attacker who already holds authenticated local code execution on a Windows host to win a use-after-free race and gain high-integrity code execution, yielding full confidentiality and integrity impact (CVSS 3.1 base 7.0, AV:L/AC:H/PR:L/UI:N). Every supported Windows client and server branch is affected - from Windows Server 2012 through Windows Server 2025 and Windows 10 1607/1809/21H2/22H2 through Windows 11 23H2/24H2/25H2/26H1/26H2 - because the vulnerable console driver ships in the base OS. No public exploit has been identified at time of analysis and CISA's SSVC assessment rates exploitation as 'none' with automatable exploitation as 'no', so this is a moderate-priority local EoP hardening item rather than an internet-facing emergency; the practical limiting factors are the precondition of an existing local foothold (PR:L) and the high attack complexity of the memory-reuse race.
Local privilege escalation in Windows Shell allows an attacker who already holds a low-privileged, authenticated account on a Windows host to traverse relative paths and raise their privileges to a higher integrity level (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is not a remote or initial-access vector - it requires existing local code execution or account access, but needs no user interaction and is low-complexity once that foothold exists. CISA's SSVC assessment records no observed exploitation and no automatable path, and no public exploit has been identified at time of analysis; vendor patches are available, making this a credible but second-tier prioritization compared with actively exploited or remotely reachable issues.
Local privilege escalation in Windows Security Center lets an attacker who already holds a foothold on a Windows host with low-level privileges (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.0 High) abuse an improperly restricted communication channel to obtain high confidentiality and integrity impact on the same machine. Only hosts that have not yet applied the current cumulative builds are affected, spanning Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2016/2019 including Server Core installations. The high attack complexity indicates a non-trivial precondition - most consistent with a race or transient-state condition that must be won to redirect or spoof the endpoint - so reliability is limited; prior local access and valid credentials are mandatory and no public exploit identified at time of analysis, with no CISA KEV listing.
Privilege escalation in Windows OLE DB allows an unauthenticated remote attacker to elevate to SYSTEM by inducing a victim to open a crafted file or connect to an attacker-controlled data source that a vulnerable OLE DB provider parses, causing a heap-based buffer overflow (CWE-122). The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) confirms authentication is not required, but user interaction is mandatory - there is no zero-click network path, which is the main limiting factor. All default Windows installations are affected across Windows 10, Windows 11 (22H2 through 26H2) and Windows Server 2012 through 2025 including Server Core; there is no public exploit identified at time of analysis and CISA SSVC records exploitation as none, so this is a high-priority patch item rather than an emergency.
Local privilege escalation in the Windows Win32k kernel subsystem allows an authenticated, low-privileged attacker already running code on a Windows host to corrupt kernel memory and gain SYSTEM-level execution. The flaw is a use-after-free (CWE-416) reachable from a standard user context; per the assessed vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H it requires pre-existing local, authenticated access (PR:L, AV:L) with no remote or unauthenticated path, and the high attack complexity (AC:H) reflects the need to win a timing/race window and reliably reclaim the freed object, which lowers exploitation reliability. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); Microsoft rates it 7.0 (High) and has released fixes across all supported Windows 10, Windows 11, and Windows Server branches.
Remote code execution is possible on Windows hosts that have the Network Policy Server (NPS) role deployed, where an authenticated attacker with network reach to the service can trigger a heap-based buffer overflow (CWE-122) and potentially take over the NPS process (CVSS 7.5; CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Because NPS is the Windows RADIUS/802.1X authentication service and is not installed by default, exposure is effectively limited to servers functioning as RADIUS or NAP infrastructure, and the high attack complexity (AC:H) reflects the heap grooming typically required for reliable exploitation rather than an easily automated attack. There is no public exploit identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' with automatable 'no', and a vendor patch is available, so this is a genuine but not top-tier priority that should be handled in normal patch cadence.
Local privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) lets an authenticated attacker who already holds low-level code execution on a host raise privileges to SYSTEM on unpatched Windows 10, Windows 11, and Windows Server builds. The bug is a kernel type confusion (CWE-843) in an always-present, in-box WinSock component reachable by ordinary users through standard socket APIs, but exploitation is rated high-complexity (AV:L/AC:H/PR:L/UI:N) because a reliable trigger likely depends on winning a race or reaching a precise kernel object/memory state, which lowers real-world reliability. This is a genuine but moderate-priority local privilege-escalation issue: no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV), while Microsoft has published fixes through its standard update channel.
Local privilege escalation in Windows Push Notifications allows an attacker who already holds a low-privileged authenticated local session to gain SYSTEM-level code execution by exploiting a timing-dependent use-after-free (CWE-416), but the high complexity score (AC:H) and race-condition requirement make successful exploitation unreliable. Microsoft has released patches, and no public exploit has been identified at time of analysis. The flaw scores 7.0 CVSS and can lead to full confidentiality, integrity, and availability impact, yet the mandatory local access prerequisite makes it a genuine but not top-priority issue.
Windows PowerShell on supported Windows client and server editions fails to enforce a protection mechanism, letting a locally authenticated low-privileged attacker bypass a security feature and operate outside the intended security boundary, achieving high confidentiality, integrity, and availability impact (CVSS 8.8, scope-changed). Exploitation requires a pre-existing local foothold and the ability to run PowerShell on the host - there is no remote or unauthenticated path, and CISA's SSVC assessment rates exploitation as 'none' with Automatable=no, meaning the issue is not wormable or easily mass-scanned. There is no public exploit identified at time of analysis, though the technical impact is rated total once the prerequisite access is obtained; Microsoft has released fixes and the MSRC update guide is the authoritative remediation source.
Local privilege escalation in the Windows Search component affects every pre-patch build of supported Windows client and server editions, letting an attacker who already holds low-privileged local access execute code at a higher integrity level by exploiting a numeric truncation error in the search/indexing code path. Rated CVSS 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), the flaw requires local authenticated access (PR:L, AV:L) but no victim interaction (UI:N) and has low attack complexity, making it a post-compromise escalation primitive rather than a remote or initial-access vector. CISA's SSVC assessment records exploitation as 'none' and automatable as 'no', and no public exploit code has been identified at time of analysis; vendor patches are available from Microsoft.
Local privilege escalation in the Windows Win32k kernel subsystem (CVE-2026-70176) allows an authenticated attacker who already holds low-privileged local access on a host to elevate their privileges by triggering a use-after-free in kernel-mode code, rated CVSS 7.0 (High, AV:L/PR:L/AC:H/UI:N). The flaw sits in a component that is present by default in every supported Windows edition and cannot be disabled or removed, so no special configuration is required to reach the vulnerable code; the main obstacle for an attacker is the high attack complexity of the required free/reuse race, which lowers reliability and may force repeated attempts. Microsoft has published a vendor patch, there is no CISA KEV listing, and no public exploit code has been identified at time of analysis, though the ENISA EUVD record and MSRC advisory confirm a wide set of affected Windows 10, Windows 11, and Windows Server 2016-2025 (including Server Core) builds.
Local privilege escalation in Microsoft Windows NTFS lets an authenticated attacker who already has low-privileged code execution on the host escalate to kernel/SYSTEM level by driving the filesystem driver into an untrusted pointer dereference (CWE-822). The flaw is local-only (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) and affects every listed Windows 10, Windows 11 (23H2 through 26H2) and Windows Server 2012 through Server 2025 build below its patched revision, since NTFS is the default Windows filesystem and no non-default configuration is required. There is no public exploit identified at time of analysis and CISA SSVC rates Exploitation=none and Automatable=no; Microsoft has shipped vendor patches, making this a credible but not emergency-level priority.
Local privilege escalation in the Windows Connected Devices Platform Service (CDPSvc) affects a broad set of Windows 10, Windows 11, Windows Server 2019, 2022 and 2025 builds, allowing an attacker who already holds an authenticated low-privileged local account to raise their privileges to a higher integrity level. The flaw is a race condition (CWE-362) in which concurrent access to an improperly synchronized shared resource can be timed to corrupt service state; the narrow, hard-to-control timing window is reflected in the high attack complexity (AC:H) of the assessed CVSS 7.0 (High) vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning remote or anonymous exploitation is not possible and success likely requires repeated attempts. Vendor patches are available and no public exploit code has been identified at time of analysis; the service ships by default on supported editions, so exposure is limited mainly by the requirement for pre-existing local access.
Local privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows an authenticated, low-privileged attacker who already has local code execution on the host to corrupt kernel memory and elevate to SYSTEM by winning a timing-dependent use-after-free race in the socket subsystem. The flaw is rated CVSS 7.0 (AV:L/AC:H/PR:L/UI:N, total technical impact), requires no user interaction, and affects unpatched Windows 10, Windows 11, and Windows Server 2012 through 2025 builds, though exploitation is non-trivial and not automatable per CISA SSVC (Automatable: no). No public exploit code or confirmed active exploitation has been identified at time of analysis, and vendor-released patches are available for every affected build.
Local privilege escalation in the Windows TCP/IP stack allows an authenticated attacker who already holds low-privileged code execution on a host to corrupt kernel memory and elevate to a higher-integrity context. The flaw is a use-after-free (CWE-416) that requires winning a race condition (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.0), which limits reliability and keeps the flaw non-automatable per the CISA SSVC assessment; no public exploit code has been identified at time of analysis and exploitation has not been observed. Every supported Windows client and server edition, including Server Core installations, is affected until updated to the fixed builds published by Microsoft, and practical risk is concentrated on shared or multi-user hosts where untrusted users can run local code.
Denial of service in the OpenSSH server component (sshd) shipped as an optional feature of Windows allows an unauthenticated, remote attacker who can reach the SSH port to consume host resources without throttling, degrading or exhausting the service so legitimate SSH sessions can no longer be established. Only Windows builds that actually have the OpenSSH Server capability installed, enabled and network-reachable are at risk - the feature is not on by default for most client installs, which materially narrows the attack surface, and the impact is availability-only (C:N/I:N/A:H). The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5), CISA's SSVC assessment records exploitation as none, automatable as yes and technical impact as partial, and there is no public exploit identified at time of analysis; a vendor fix is available.
Local privilege escalation in the Windows kernel allows an authenticated attacker holding only low privileges on a vulnerable host to trigger a use-after-free (CWE-416) and gain code execution at higher integrity, with full confidentiality, integrity and availability impact per the CVSS vector (7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The attacker must already be logged on locally and no user interaction is required, but the high attack complexity means success depends on reliably reclaiming a freed kernel object, a timing-sensitive operation requiring build-specific memory-layout knowledge across the large set of affected Windows 10, Windows 11 and Windows Server builds below their fixed patch levels. No public exploit code or confirmed active exploitation was identified at time of analysis, and the CISA SSVC assessment records exploitation as 'none' and not automatable, making this a moderate-priority patch item rather than an emergency; vendor patches with explicit fixed build numbers are available via the Microsoft Security Response Center advisory.
Remote code execution in the Windows Routing and Remote Access Service (RRAS) affects Windows 10, Windows 11 and Windows Server 2012 through 2025 hosts on which the RRAS role is installed, with the CVSS 3.1 vector (8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicating a network-reachable attacker who already holds a low-privilege authenticated position, requires no user interaction, and can achieve full confidentiality, integrity and availability impact. The defect is a double free (CWE-415) memory-corruption condition in the service, which Microsoft has addressed in its monthly update with fixed builds published for each supported branch. There is no public exploit identified at time of analysis and no confirmed actively exploited (CISA KEV) status, and real-world exposure is materially narrowed because RRAS is not enabled by default on standard Windows installations.
Unauthenticated remote code execution is possible against the Windows System Information Console, where a heap-based buffer overflow (CWE-122) reachable over the network lets an attacker with no credentials and no user interaction run arbitrary code in the context of the affected component. Every supported Windows client and server build remains vulnerable until the vendor's security updates are applied - for example Windows 11 24H2 build 10.0.26100.9711, Windows Server 2025 build 10.0.26100.33650, and Windows Server 2016 build 10.0.14393.9612. Exploitation has not been observed (CISA SSVC exploitation: none) and no public exploit code is identified at time of analysis, but with CVSS 9.8, an automatable attack path, and total technical impact, the divergence between the severity signal and the quiet exploitation picture is the central risk consideration - the practical constraint is simply whether the affected component is network-reachable on a given host.
Local privilege escalation in the Microsoft Windows Search Component allows an attacker who already holds a low-privileged, authenticated session on a Windows host to trigger a use-after-free and escalate to SYSTEM-level code execution. Affected systems are Windows 10, Windows 11 (23H2, 24H2, 25H2, 26H1 and 26H2) and Windows Server 2012 through 2025 editions running builds below the fixed levels published for CVE-2026-70156; the component is enabled by default on all of them, so no non-default configuration is required. Rated CVSS 3.1 base 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), exploitation hinges on winning a race or achieving a precise heap-reuse state, which lowers reliability, and no public exploit identified at time of analysis. The only material prerequisite is existing local access, making this a post-compromise escalation and persistence primitive rather than a remote entry point.
A memory-leak flaw (CWE-401) in the Microsoft Windows DNS Server service lets an unauthenticated, remote attacker gradually exhaust server memory by sending repeated DNS queries, ultimately degrading or denying DNS resolution on affected hosts. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N with availability-only impact (A:H), no credentials or user interaction are required, and any default DNS-server deployment reachable on the network is exposed; however, this is a slow resource-exhaustion condition rather than an instantaneous crash, so the practical impact scales with sustained traffic and available memory. An independent assessment rates this as a genuine but second-tier priority: SSVC indicates no known exploitation, no publicly available exploit code has been identified at time of analysis, and a vendor patch is available, making timely patching the decisive control.
Remote code execution in the Microsoft PostScript Printer Driver on unpatched Windows client and server builds allows an unauthenticated attacker to corrupt heap memory (CWE-122) by delivering crafted PostScript content over the network to a reachable print path, yielding high confidentiality, integrity, and availability impact per the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N. The full set of supported Windows 10, Windows 11, and Windows Server branches (2012 through 2025, including Server Core installations) is affected at the build levels listed in the vendor advisory, so virtually every maintained Windows print host is in scope until updated. Despite the 9.8 base score, CISA's SSVC assessment records Exploitation as 'none' and no public exploit code has been identified at time of analysis, so this should be treated as a critical, patch-immediately issue rather than an actively exploited one; Microsoft has released fixing updates through the Security Update Guide (MSRC, mirrored as ENISA EUVD-2026-100162).
A use-after-free in the Microsoft Windows Search Component allows an authenticated local attacker with low privileges to elevate to SYSTEM-level code execution on affected Windows client and server builds. Exploitation requires the attacker to already be running code on the host and is constrained by high attack complexity (AC:H), consistent with winning a memory-reuse race in the search/indexing component that depends on precise timing and heap state and may need repeated attempts; no user interaction is required. This is a moderate-priority local privilege-escalation issue rather than an emergency: there is no public exploit identified at time of analysis, SSVC records Exploitation as 'none', and Microsoft has released fixes (vendor advisory https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70150).
A heap over-read in the Windows Client Side Caching driver (csc.sys) allows an attacker to disclose sensitive memory contents, affecting Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025 builds prior to the vendor's fixed revisions. Microsoft's advisory carries a CVSS 8.8 score with a network, user-interaction vector (AV:N/PR:N/UI:R), whereas the independent assessment bounds the flaw to an authorized attacker who already holds local access on the host (AV:L/PR:L/UI:N) - a material conflict that should be resolved against the vendor advisory before prioritization. Vendor patches are available and no public exploit code has been identified at time of analysis; CISA's SSVC record lists exploitation as 'none' and automatable as 'no', and no EPSS score was supplied.
Remote code execution is possible in the Microsoft PostScript Printer Driver, where a heap-based buffer overflow (CWE-122) lets an unauthenticated attacker who can deliver crafted PostScript print data over the network corrupt heap memory and execute arbitrary code in the context of the Windows Print Spooler. The flaw carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no authentication and no user interaction are required; every supported Windows client and server release from Windows Server 2012 through Windows 11 26H2 and Windows Server 2025 is affected unless it has been updated to the fixed build listed by Microsoft. Vendor patches are available, and no public exploit code or active exploitation has been identified at time of analysis - SSVC records exploitation as 'none' - so the practical exposure is driven by whether the print/spooler service is reachable from untrusted networks.
A heap-based buffer overflow in the Windows Network File System (NFS) Server role lets an attacker who already holds local, low-privileged authenticated access on a Windows host execute code in a higher-privileged context, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base 7.8, AV:L/PR:L/UI:N). Exploitation is constrained by prerequisites: the optional NFS Server / Services for NFS feature must actually be installed and enabled - it is absent from default Windows installations - and the attacker must already be on the box with valid low-privilege credentials; no user interaction is required. Vendor-released patches exist for all listed Windows client and server builds, no public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV), so this is a moderate-to-serious patching priority rather than a top-tier emergency. Defenders should note the scoring discrepancy flagged in the independent assessment: NFS is a network-facing service, yet Microsoft scored the vector as LOCAL - confirm via the MSRC advisory whether any network-adjacent trigger path exists beyond the local vector.
Local privilege escalation in the Windows Audio Service lets an attacker who already holds low-privilege code execution on a Windows host trigger a use-after-free (CWE-416) and elevate to a more privileged context. The flaw is rated CVSS 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H): it is not remotely reachable, requires an existing foothold and local code execution, and the high attack complexity reflects a race/timing window that must be won, making exploitation non-deterministic. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as none and non-automatable, and the issue does not appear in CISA KEV; completely patched builds are available from Microsoft.
Local privilege escalation in the Windows Update Service lets an authenticated attacker with low-level local access (CVSS PR:L/AV:L) corrupt heap memory to gain SYSTEM-level code execution on unpatched Windows client and server builds. The flaw is a heap-based buffer overflow (CWE-122) that requires no user interaction and no special configuration, since the Windows Update Service is enabled by default; exploitation cannot be automated or performed remotely, and no public exploit code or active exploitation has been identified at time of analysis.
Local privilege escalation in Microsoft Windows OLE allows an attacker who already holds low-privileged authenticated access on a host to drive a heap-based buffer overflow by inducing the vulnerable component to process a crafted OLE object, resulting in code execution at a higher integrity level with complete loss of confidentiality, integrity, and availability (CVSS 7.8, CWE-122). The issue spans a wide set of unpatched Windows client and server builds, including Windows 10 21H2/22H2, Windows 11 23H2 through 26H2, and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025; vendor fixes are available and no public exploit code was identified at time of analysis. Because the attack is local (AV:L), requires existing credentials (PR:L), needs no victim interaction (UI:N), and is classified as non-automatable with exploitation 'none' under CISA's SSVC framework, it is a second-tier, post-compromise escalation primitive rather than a remote or wormable threat.
Local privilege escalation in the Microsoft Windows Search component lets an authenticated attacker with a low-privileged local account corrupt memory and potentially execute code at a higher integrity level. The flaw is a use-after-free (CWE-416) rated CVSS 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning exploitation is local, requires prior authentication, needs no user interaction, and carries high attack complexity because the attacker must reliably reclaim a freed object. Microsoft has released vendor patches; no public exploit code has been identified, and CISA's SSVC assessment records exploitation as none with the issue not automatable (technical impact: total).
Local privilege escalation in the Windows Event Tracing (ETW) subsystem allows an attacker who already holds low-privileged code execution on a host to raise their privileges, with high confidentiality, integrity and availability impact (CVSS 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The root cause is a use-after-free (CWE-416) that is only reachable locally and additionally requires winning a timing race, so reliable exploitation is non-trivial; no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, with CISA SSVC scoring exploitation as 'none' and automatable as 'no'. Microsoft has released a vendor patch, and risk is concentrated on multi-user, terminal/RDP, or shared systems where untrusted low-privilege accounts can run code - a moderate, not emergency, priority.
Network denial of service in Windows SMB Server allows unauthenticated remote attackers to make the service allocate resources without throttling, exhausting memory or handles until SMB-dependent services and, potentially, the host become unresponsive. Tracked as CWE-770 and scored 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), it affects Windows 10 (1607 through 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1/26H2) and Windows Server 2012 through Server 2025, with impact confined to availability - there is no disclosure or code-execution path. No public exploit has been identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' (automatable: yes, technical impact: partial), and vendor-released patches are available through the Microsoft update guide referenced by the advisory.
Local privilege escalation in the Windows Portable Device File System Driver lets an authenticated, low-privileged attacker who already has code execution on a Windows host trigger a heap-based buffer overflow (CWE-122) and elevate to SYSTEM. The flaw spans an unusually wide set of builds - Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025, including Server Core installations - and carries a vendor CVSS of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Microsoft has released fixes, CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', and no public exploit code has been identified at time of analysis; the operative constraint is the required local foothold, which makes this a second-stage escalation primitive rather than an entry point.
Heap-based buffer overflow in Microsoft Windows Media Foundation allows a local attacker to elevate privileges on affected Windows hosts by supplying a crafted media file that the logged-in user opens, previews, or otherwise has parsed by the platform's media pipeline. Successful exploitation is assessed at CVSS 3.1 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, CWE-122), yielding high confidentiality, integrity, and availability impact; because the vector is local with a user-interaction prerequisite, the attacker must first land the file on the target and induce the user to process it, which makes this a credible but interaction-gated escalation path rather than a network-facing exploit. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV); a vendor patch is available, and fully updated builds (those at or above the version thresholds enumerated in the EUVD affected-version data) are not affected. Despite being an LPE rather than an RCE, the no-privilege prerequisite, low complexity, and full three-property impact keep this a legitimate prioritization candidate in environments where media files are routinely handled.
Unauthenticated remote code execution in the Windows DNS Server role stems from a use-after-free (CWE-416) that lets an attacker who can reach the service over the network run code in the context of the DNS service. All supported Windows Server generations carrying the DNS role are affected - 2012, 2012 R2, 2016, 2019, 2022 and 2025 (including Server Core), plus Windows 10 1607 and 1809 where the role is installed - while hosts without the DNS Server role are not exposed. The practical risk is tempered by high attack complexity (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, 8.1), since reliable exploitation depends on winning a race or landing a specific heap state; no public exploit identified at time of analysis, CISA SSVC records Exploitation: none and Automatable: no, and a vendor-released patch is available - making this serious but not emergency-tier.
Memory-safety failure in the Windows Bluetooth Port Driver lets a device within Bluetooth radio range trigger out-of-bounds memory access that can escalate to code execution on unpatched Windows 10, Windows 11, and Windows Server hosts with an active Bluetooth radio. Exploitation requires proximity (adjacent network), the victim's Bluetooth to be enabled and in use, some form of user interaction such as accepting or initiating a Bluetooth connection, and high attack complexity reflecting preconditions outside the attacker's control; authentication is not required (CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H). Microsoft has shipped fixes, no public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as "none" with the attack assessed as non-automatable, and hosts with Bluetooth disabled are not exposed - making this a moderate rather than top-tier priority despite the 7.1 score and the CVSS "total" technical impact rating on affected devices.
Local privilege escalation in the Microsoft Graphics Component affects multiple Windows client and server builds, allowing a local, authenticated attacker with low privileges (CVSS AV:L/PR:L) to exploit a numeric truncation error and gain High confidentiality, integrity, and availability impact after corrupting heap memory. The vulnerability has a CVSS 3.1 base score of 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), requires no user interaction, and is not a remote entry point; no public exploit was identified at time of analysis, and no EPSS score was provided. A vendor patch is available per Microsoft, so affected organizations should prioritize update deployment on all listed Windows versions and Server Core installations.
Local privilege escalation in the Windows Kernel allows an authenticated low-privilege attacker with existing code execution on a target host to trigger a heap-based buffer overflow and elevate privileges in kernel mode. Affected default installations include Windows 10, Windows 11 21H2 through 26H1, and Windows Server 2019/2022/2025 builds below the vendor-patched build levels. No public exploit identified at time of analysis and CISA SSVC reports no exploitation; a vendor patch is available.
Heap-based buffer overflow in the Windows Win32 Kernel Subsystem allows an authenticated local attacker holding only standard user rights to corrupt kernel heap memory and elevate to full SYSTEM-level privileges on unpatched Windows hosts. The vulnerability is strictly local (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) and affects a very broad install base, spanning Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2016 through 2025, so it functions as a reliable post-compromise escalation primitive rather than an initial-access emergency. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records Exploitation: none, and the CVE is not listed in KEV; Microsoft has released vendor patches with fixed servicing builds for every affected branch.
Local privilege escalation in Microsoft's Windows Client for NFS allows an authenticated low-privileged attacker who already has code execution on a host to elevate to higher privileges (assessed CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.8). Exploitation requires the optional 'Client for NFS' feature to be installed and reachable from the attacker's context, so default installations without that component are not affected, and there is no remote or network-facing attack path. CISA's SSVC assessment records exploitation as 'none' and no public exploit code has been identified at time of analysis; Microsoft has released fixes via its update guide (MSRC advisory for CVE-2026-70113), and the issue is tracked as CWE-190 integer overflow or wraparound.
Heap-based buffer overflow in the Microsoft Windows Storage Spaces driver (Spaceport.sys) allows an authenticated, low-privileged local user to execute code in kernel context and elevate privileges, carrying a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The attacker must already hold a session on the target host, so this is best treated as a post-compromise privilege-escalation step rather than a remote entry point, and no user interaction is required beyond the existing local session. Vendor-released patches exist for all affected Windows 10, Windows 11 and Windows Server builds; no public exploit code has been identified at time of analysis and CISA's SSVC assessment records exploitation as "none". Compared with network-facing, pre-authentication bugs this rates as a credible but not emergency-tier priority: patch it on a normal cycle, but prioritize systems where untrusted or low-privileged users can obtain local interactive sessions.
Elevation of privilege in the Microsoft Windows Kernel lets an unauthenticated, remote attacker who can reach the affected kernel code path corrupt or redirect kernel memory and gain SYSTEM-level control of the target host. All currently supported Windows client and server families are in scope - Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations - and the assessment vector (AV:N/AC:H/PR:N/UI:N, C:H/I:H/A:H, base 8.1) confirms no credentials or user interaction are needed. The decisive limitation is attack complexity: the attacker must control or influence an untrusted pointer and win a precise kernel memory-layout or timing condition, so this is not a single-shot request. Microsoft has published a fix and there is confirmed vendor patch availability, but no CISA KEV listing and no public exploit code identified at time of analysis; the practical verdict is a genuine high-priority patching candidate rather than a drop-everything emergency.
Local privilege escalation in the Microsoft PostScript Printer Driver allows a low-privileged user on an affected Windows host to gain elevated code execution by having attacker-controlled PostScript/print-driver data processed on the machine, with the root cause classified as a CWE-121 stack-based buffer overflow and a CVSS base score of 7.8. The vector (AV:L/AC:L/PR:N/UI:R) shows no privileges are required prior to exploitation (PR:N) but local presence is mandatory and the victim must be induced to trigger processing of the malicious data (UI:R); CISA's SSVC assessment records Exploitation=none and Automatable=no, and no public exploit code has been identified at time of analysis. This is a credible but context-dependent post-compromise escalation step rather than a mass-exploitation emergency, and a vendor patch is available.
A heap-based buffer overflow (CWE-122) in the Microsoft PostScript Printer Driver lets a local attacker who persuades a victim to process a crafted PostScript print job or document elevate privileges on affected Windows client and server releases. The flaw requires local access (AV:L) and user interaction (UI:R) but no prior privileges (PR:N), so it is a targeted rather than opportunistic local privilege-escalation vector; CISA SSVC rates it non-automatable with no observed exploitation, and no public exploit code has been identified at time of analysis. Vendor patches are available and, per the assessed impact (C:H/I:H/A:H), successful exploitation gives full code execution in the driver's higher-privileged context.
Heap-based buffer overflow in the Windows Win32 kernel subsystem lets a locally authenticated low-privilege attacker escalate to full system privileges on an affected host. Every supported Windows build in the EUVD-listed ranges is exposed by default - Windows 10 21H2 and 22H2, Windows 11 23H2 through 26H2 (including 26H1), and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 in both full and Server Core installations - until the corresponding cumulative update is applied; CVSS 3.1 is 7.8 (AV:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so impact on confidentiality, integrity and availability is total once the primitive is triggered. Microsoft has published fixes in its update guide, and no public exploit code or active exploitation has been identified at time of analysis (CISA SSVC exploitation: none). The practical barrier is that the attacker must already hold local code execution on the target, making this a post-compromise privilege-escalation step rather than an initial-access vector.
Heap-based buffer overflow in the Windows kernel (CVE-2026-70106) allows an attacker who already holds low-privileged local code execution to elevate privileges on the affected host, scoring 7.8 under CVSS v3.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exposure is broad across build numbers - Windows 10, Windows 11 and Windows Server 2012 through 2025, including Server Core - but the attack is gated behind an existing local foothold, so it is a post-compromise escalation primitive rather than a remotely reachable one. Microsoft has released fixes through the MSRC update guide, and no public exploit code or confirmed active exploitation was identified at time of analysis (CISA SSVC exploitation: none).
Local privilege escalation in the Windows Win32 Kernel Subsystem lets an attacker who already holds low-privileged, authenticated code execution on a Windows host raise their privileges to kernel level. The flaw is an untrusted pointer dereference (CWE-822) in the kernel that can be triggered with low attack complexity and no user interaction, giving high impact to confidentiality, integrity, and availability (CVSS 3.1 7.8, AV:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No public exploit code has been identified and CISA's SSVC assessment records exploitation as none and automatable as no, so this is a credible but not emergency-level priority; the main constraint on attackers is the need for a pre-existing local foothold on an unpatched build.
Heap-based buffer overflow in Microsoft Windows Error Reporting (WER) lets a locally authenticated attacker holding only low-level privileges elevate their privileges on the host, with full confidentiality, integrity and availability impact (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No user interaction or non-default configuration is required because WER is a built-in subsystem present across every affected Windows 10, Windows 11 and Windows Server 2016-2025 SKU, but the flaw is not remotely exploitable: the attacker must already be able to run code locally under a valid low-privilege account. There is no confirmed active exploitation (the CVE is not in CISA KEV) and no public exploit code identified at time of analysis; Microsoft has published a fix and an advisory entry for the issue, so affected builds below the fixed thresholds should be updated.
Local privilege escalation in the Microsoft Windows Storage Spaces driver (Spaceport.sys) lets an authenticated, low-privileged attacker who already has code execution on a host corrupt kernel memory and obtain SYSTEM-level rights. The defect is a use-after-free (CWE-416) that is locally reachable with low attack complexity and no user interaction, and it affects Windows 10, Windows 11 and Windows Server builds below the fixed versions enumerated in the vendor update. No public exploit code has been identified and CISA's SSVC decision data records no exploitation activity, so this is a genuine but second-tier patching priority relative to any actively exploited issue in the same release cycle.
Heap-based buffer overflow in the Windows iSCSI Initiator component allows a remote unauthenticated attacker to execute arbitrary code on affected Windows 10, Windows 11, and Windows Server 2012 through 2025 systems, provided the target actually uses iSCSI and a user or administrator initiates or accepts a connection to an attacker-controlled iSCSI target (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.5). The user-interaction requirement and High attack complexity - the attacker must also satisfy memory-layout or timing conditions to convert the overflow into reliable code execution - sharply limit the practical attack surface to environments that deploy iSCSI storage. Vendor-released patches are available from Microsoft, CISA's SSVC decision framework rates exploitation as none and automatable as no, and no public exploit identified at time of analysis.
Local privilege escalation in the Windows Rich Text Edit Control (the riched20/msftedit engine used by WordPad, Outlook, and many applications that render Rich Text Format content) lets an attacker who already holds authenticated low-privileged access on a Windows host trigger a heap-based buffer overflow and obtain higher-integrity code execution. Exploitation requires the attacker to invoke the control with attacker-controlled rich-text content (CVSS PR:L, UI:N), so it is a post-compromise escalation primitive rather than a remote or unauthenticated path; SSVC rates the technical impact as total but flags the issue as not automatable, meaning reliable mass exploitation is unlikely, and no public exploit was identified at time of analysis. Microsoft has published a vendor fix, so the residual risk is concentrated on unpatched Windows 10, Windows 11, and Windows Server builds where a low-privileged foothold already exists.
Local privilege escalation in the Microsoft PostScript Printer Driver allows an attacker who gets a victim to open or print a crafted PostScript payload to trigger a heap-based buffer overflow (CWE-122) and execute code in the context of the affected Windows printing component. The flaw affects a broad range of Windows client and server builds - including Windows 10/11 and Windows Server 2012 through 2025 - that have not been updated to their fixed build revision. Per the CVSS vector the attacker needs no pre-existing account (PR:N), but exploitation is local (AV:L) and requires user interaction (UI:R), a crafted document must be processed on the target, and no public exploit code or active exploitation was identified at time of analysis (CISA SSVC: Exploitation = none, Automatable = no).
Heap-based buffer overflow in Microsoft Windows GDI (CWE-122) lets remote attackers achieve code execution on a fully updated-adjacent target by convincing a user to open or preview a maliciously crafted image or document that is parsed through the Windows Graphics Device Interface; the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (8.8) indicates no authentication is needed but that the victim must interact with the attacker-supplied file. Code execution occurs in the security context of the user who opened the file, so the impact is bounded by that user's privileges and no scope change occurs. No public exploit code has been identified at time of analysis and the CISA SSVC decision framework records Exploitation: none with Automatable: no, while Technical Impact is rated total; there is no KEV listing, so this is a high-priority patching item rather than an emergency. Microsoft has published fixed builds covering Windows 10, Windows 11 and Windows Server 2012 through 2025.
Local privilege escalation in Microsoft's Windows Search Component lets an authenticated attacker who already holds a low-privileged session on a Windows host trigger a use-after-free and elevate to a more privileged security context on the same machine. Exploitation is constrained by a high attack complexity rating (AC:H), reflecting a race/timing condition on the freed object that must be won reliably, and the vector (AV:L/PR:L/UI:N) confirms the attacker must already be logged in locally with low privileges; there is no remote attack surface and no victim interaction required. Patches are available from Microsoft (fixed builds such as Windows 11 24H2 10.0.26100.9711 or later), CISA's SSVC assessment records exploitation as none and the issue as not automatable, and no public exploit code has been identified at time of analysis.
Denial of service in the Windows DNS Server role allows an unauthenticated remote attacker to take DNS name resolution offline on affected Windows Server hosts by sending a crafted request that drives the service into an unhandled exception. Impact is limited to availability (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) with no confidentiality or integrity loss, and no public exploit was identified at time of analysis (CISA SSVC Exploitation: none, though the bug is rated Automatable: yes). Any Windows Server 2012, 2012 R2, 2016, 2019, 2022 or 2025 system - including Server Core installations - that runs the DNS Server role and is reachable on its DNS listening port is exposed; internal resolvers behind firewalls are materially less at risk than internet-facing ones.
Unauthenticated remote attackers who can reach a Windows DNS Server over UDP/TCP 53 can drive the service into a denial-of-service state on affected Windows Server 2012 through 2025 (including Server Core) and Windows 10 1607/1809 builds. The defect is a workflow/state-enforcement logic flaw rather than memory corruption, and the assessed impact is availability-only (C:N/I:N/A:H), which produces the CVSS 3.1 base score of 7.5 with PR:N, AC:L and UI:N. No public exploit identified at time of analysis, and CISA's SSVC rates exploitation as none while marking the issue automatable, so it is a credible but second-tier priority; Microsoft has released fixes in the monthly Windows security update.
Stack-based buffer overflow in Windows DHCP Server allows an authenticated attacker with low-level network privileges to run arbitrary code on unpatched Windows Server and Windows 10 systems where the DHCP Server service is present. The flaw is network-reachable, low-complexity, and needs no user interaction, but PR:L means the attacker must already have an authenticated foothold; CISA SSVC rates exploitation as none and not automatable, and no public exploit code is identified at time of analysis. Vendor patches are available, making this a serious flaw to prioritize on exposed DHCP servers rather than an immediate emergency.
Privilege elevation on unpatched Windows hosts is possible through a heap-based buffer overflow (CWE-122) in the Client-Side Caching (CSC) / Offline Files service, which caches content fetched from SMB network shares. The assessed vector (AV:N/AC:L/PR:N/UI:R) describes an unauthenticated remote attacker, but success hinges on a victim interacting - typically by connecting to or accessing an attacker-controlled share so CSC parses a crafted response and overflows a heap buffer - which is consistent with SSVC rating automatic exploitation as 'no' and with the SSVC exploitation signal of 'none'. Microsoft has released patches for every affected build, and no public exploit code has been identified at time of analysis, so this is a serious but not emergency-grade issue demanding prompt, scheduled patching rather than crisis response.
Local privilege escalation to SYSTEM in the Windows Win32k kernel subsystem affects Windows 10, Windows 11, and Windows Server releases, allowing an authenticated low-privileged attacker already executing code on the host to exploit a use-after-free (CWE-416) condition and gain full kernel-level control (CVSS 3.1 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The high attack complexity (AC:H) reflects the need to reliably win a race or groom the kernel heap, and there is no remote or network vector, so multi-user, RDP/terminal-server, and kiosk systems are the most relevant risk surface. No public exploit code or active exploitation has been identified at time of analysis.
Local privilege escalation in Windows DHCP Server lets an authenticated, low-privileged user trigger a use-after-free (CWE-416) in the DHCP Server service and obtain SYSTEM-level code execution on the host. It is rated CVSS 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning the attacker must already have local access and must win a non-deterministic race to reach the freed-memory window, so the flaw is not remotely reachable and is best treated as a post-compromise escalation step on provisioned DHCP infrastructure rather than an emergency. No public exploit identified at time of analysis, CISA SSVC records Exploitation: none and Automatable: no, and vendor patch is available per the Microsoft advisory.
Integer underflow in the Windows Kerberos authentication component allows a locally authenticated attacker to elevate privileges on an affected host, giving full control over confidentiality, integrity, and availability of the machine. Exploitation requires a prior foothold: the attacker must already hold a valid low-privileged local account (PR:L, AV:L), and no user interaction is needed once that access exists; the flaw is not remotely reachable and SSVC rates it non-automatable, so it cannot be driven at mass or wormable scale. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV), but a vendor patch is available from Microsoft and should be applied to the extensive list of affected Windows 10, Windows 11, and Windows Server builds.
Memory corruption in the libarchive component bundled with Windows (the library behind tar.exe/bsdtar) lets a remote, unauthenticated attacker execute code on affected hosts by having them process a maliciously crafted archive. The root cause is a double free (CWE-415) during archive parsing that corrupts the heap, and because reliably converting that corruption into code execution requires precise heap grooming, Microsoft and our own assessment both rate attack complexity as High despite a CVSS base score of 8.1. No public exploit code has been identified at time of analysis, CISA's SSVC decision framework records exploitation as none and automatable as no, and vendor patches are already available for every affected Windows 10, Windows 11 and Windows Server branch, so this is a serious-but-not-emergency issue that should be closed on a normal patch cadence. One caveat: Microsoft's vector lists UI:N (no user interaction) while our independent assessment uses UI:R, since in interactive deployments a user or application typically has to initiate extraction of the hostile archive - an unattended/service context is where the impact is highest.
Local privilege escalation in the Microsoft Windows Win32 kernel subsystem allows an attacker who already holds low-privilege local access on a Windows host to corrupt heap memory and gain SYSTEM-level code execution. The flaw is a heap-based buffer overflow (CWE-122) rated CVSS 7.8 with a vector of AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning the attacker must be authenticated locally (PR:L, AV:L) and needs to run a crafted program that reaches the vulnerable kernel code path, with no user interaction required. There is no public exploit identified at time of analysis, CISA's SSVC assessment records Exploitation=none and Automatable=no, and vendor-released patches are available for all affected Windows client and server builds.
Local privilege escalation in Microsoft Windows OLE allows an authenticated attacker who already holds a low-privileged foothold on a host to corrupt heap memory through crafted OLE object handling and execute code at a higher integrity level, matching the assessed CVSS:3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8). Scope is limited to unpatched Windows 10, Windows 11 and Windows Server 2012 through 2025 builds listed by EUVD; because the vector is local-only with PR:L, the flaw is not remotely reachable and cannot be triggered against a default configuration by an outside party. CISA SSVC rates exploitation as "none" and automatable as "no", there is no public exploit identified at time of analysis, and Microsoft has shipped fixes via its Update Guide, making this a credible but not emergency-level priority.
Memory corruption in the Microsoft Windows DHCP Server role allows unauthenticated remote attackers to execute arbitrary code on affected servers over the network. Only systems with the DHCP Server role installed and running are exposed - the attack surface is the DHCP service itself (typically UDP 67), while ordinary Windows clients and servers without that role are not vulnerable. Affected builds span Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 (including Server Core installations) as well as Windows 10 versions 1607 and 1809 below the listed patch levels. No public exploit code has been identified at time of analysis, and CISA's SSVC assessment records no observed exploitation and a non-automatable attack profile, although technical impact is rated total; a vendor patch is available. Note that the vendor-published base vector (7.5) reflects an availability-only impact, whereas the independent assessment scores confidentiality, integrity and availability all High (full code execution).
Local privilege escalation in the Windows Update Service allows an attacker who already possesses valid low-privileged local access on an affected Windows host to elevate to a higher-integrity context (including SYSTEM) by triggering a use-after-free. The attack is entirely local - there is no network-facing path - and the assessed vector (AV:L/AC:H/PR:L/UI:N) means successful exploitation depends on winning a race/timing window inherent to the memory-reuse condition, so reliable elevation may require multiple attempts and is not a deterministic one-shot. Affected unpatched builds span Windows 10 21H2/22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2019/2022/2025 (Server Core included); no public exploit code has been identified at time of analysis and there is no CISA KEV confirmation of active exploitation, making this a legitimate but moderate-priority LPE rather than an urgent, broadly exploited threat.
Heap-based memory corruption in the Windows NetBIOS component lets an authenticated local attacker with only low-privileged code execution elevate to SYSTEM on unpatched hosts. Exploitation requires an existing foothold - a valid local account and the ability to run code on the target - so this is a post-compromise escalation primitive, not a remote or initial-access vector; no user interaction is required (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8). Microsoft has released fixes and CISA's SSVC assessment rates exploitation as 'none' and the issue as non-automatable, so despite a total technical impact this rates as a genuine but not emergency-tier priority; no public exploit code was identified at time of analysis.
Local privilege escalation in Windows SmartScreen allows an attacker who already holds a low-privileged interactive session on a Windows host to corrupt memory through a type-confusion condition and elevate to a higher-integrity context, with full loss of confidentiality, integrity, and availability if successful. Exploitation is local only (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8): there is no remote or network vector, and the attacker must first establish code execution on the target before triggering the flaw. Microsoft has released fixes, and CISA's SSVC review rates exploitation as none observed and not automatable, so this is best treated as a manual post-compromise escalation step rather than a mass-exploitation threat; no public exploit code or KEV listing is associated with the CVE at time of analysis.
A heap-based buffer overflow in the Windows Resilient File System (ReFS) driver (refs.sys) allows a locally authenticated, low-privileged attacker to corrupt kernel heap memory and elevate privileges to SYSTEM on affected Windows 10, Windows 11, and Windows Server builds. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and requires the attacker to already have a foothold on the host plus the ability to feed attacker-controlled input through the ReFS code path, which in practice means a ReFS-formatted volume must be present or mounted for the driver to process that input. Vendor patches are available per the Microsoft advisory, and no public exploit code has been identified at time of analysis (SSVC: Exploitation none, Automatable no); CISA's SSVC framing rates technical impact as total if successfully triggered, but the local-only, authenticated prerequisite and the non-default status of ReFS keep real-world urgency moderate.
Local privilege escalation in Windows Work Folders allows an attacker who already holds authenticated, low-privileged access on an affected Windows 10, Windows 11, or Windows Server host to trigger a use-after-free in the Work Folders code path, corrupting memory and potentially executing code with elevated privileges. The independently assessed vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0) confirms this is a post-compromise escalation step that requires an existing local foothold and a reliably won race/timing window, with no user interaction; there is no public exploit identified at time of analysis and CISA's SSVC assessment records exploitation as none and automatable as no. Microsoft has released fixed builds through the MSRC update guide, so the primary risk is to unpatched hosts where the Work Folders feature is present and in use.
Remote code execution in the Microsoft Windows iSCSI Initiator component (reported against Windows releases carrying the affected MSiSCSI/iSCSI code path) allows an unauthenticated, remote attacker to corrupt heap memory and execute arbitrary code in the context of the iSCSI service by driving a crafted iSCSI protocol exchange against the target. The flaw is a memory-safety defect (reported as a use-after-free, with vendor metadata also flagging buffer/heap overflow and denial-of-service characteristics) reachable from CVSS vector AV:N/AC:H/PR:N/UI:N, so no credentials or user interaction are needed and impact is scored C:H/I:H/A:H - full confidentiality, integrity and availability loss on the host. Exploitation is gated by prerequisites rather than by authentication: the victim host must have the iSCSI Initiator running and must establish a session with an attacker-controlled or spoofed iSCSI target, and the AC:H rating reflects a race/timing condition (or protocol state dependency) the attacker must win reliably. No public exploit code and no confirmed active exploitation (no CISA KEV listing) were identified at time of analysis, so this should be prioritized on exposure and asset criticality rather than on observed in-the-wild activity.
Unauthenticated network traffic against the Remote Desktop Gateway (RD Gateway) role service on unpatched Windows Server builds causes a memory leak that is never released, progressively exhausting server memory until the gateway can no longer broker remote desktop sessions (CWE-401, CVSS 7.5, availability-only). Only hosts where the RD Gateway role service is installed, running, and reachable over the network are affected - typically internet-facing servers listening on TCP 443 - while servers without that role are not in scope. CISA's SSVC assessment records Exploitation: none and Technical Impact: partial, with Automatable: yes, and no public exploit has been identified at time of analysis; a vendor patch is available, so exposure is bounded to the enumerated pre-patch build ranges.
Heap corruption in the Microsoft Windows iSCSI service lets an unauthenticated remote attacker crash or destabilize the service, yielding a denial-of-service condition on any host that has the iSCSI listener enabled and network-reachable. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms network reachability with no credentials, no user interaction, and no non-default configuration beyond the service being turned on, and the impact is confined to availability with no data disclosure or modification. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS or CISA KEV signal was supplied; exposure is therefore driven primarily by deployment, since hosts that do not run the iSCSI service or that firewall its port are not reachable.
Use-after-free in Windows Secure Kernel Mode allows an authenticated attacker running code locally on the target with low/standard-user privileges to escalate to higher privilege levels on affected Windows 10, Windows 11 and Windows Server 2019-2025 builds that are below their patched versions. The flaw is rated CVSS 7.0 (HIGH); no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis, and exploitation is gated by high attack complexity because a reliable UAF typically requires winning a timing race or precisely grooming Secure Kernel memory. Microsoft has released vendor patches - applying the fixed builds removes the condition entirely.
Remote unauthenticated code execution affects Microsoft Internet Information Services (IIS) on Windows: a stack-based buffer overflow in a request-handling parsing path is reachable over the network by anyone who can send crafted input to a running IIS instance. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) indicates no authentication, no user interaction, and no prior privileges are needed, and a successful exploit yields full loss of confidentiality, integrity, and availability on the host. No public exploit code was identified at time of analysis and there is no CISA KEV listing, but the combination of low attack complexity and unauthenticated network reachability makes this a high-priority item for any internet-facing IIS deployment; version and build specifics must be confirmed from Microsoft's advisory, since no CPE or version detail is provided in the available intelligence.
Local privilege escalation in Microsoft Windows Hyper-V lets an authenticated, low-privileged attacker who already has code execution on a host with the Hyper-V role enabled trigger a use-after-free in a Hyper-V component and gain SYSTEM-level code execution (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N/S:U with C:H/I:H/A:H). Affected builds span Windows 10 1809/21H2/22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2019, 2022, and 2025 including Server Core installations; no public exploit code has been identified at time of analysis and CISA SSVC records exploitation as none with Automatable: no, so risk is concentrated on multi-tenant, shared, or virtualization hosts where untrusted low-privilege principals already run. Microsoft has released fixes through the standard Windows cumulative update channel (MSRC advisory CVE-2026-70023, mirrored in ENISA EUVD-2026-100338), and administrators of Hyper-V hosts should treat this as a priority local escalation patch rather than a remote emergency.
Local privilege escalation in the Windows Local Security Authority Subsystem Service (LSASS) allows an authenticated attacker with an existing low-privileged foothold on a host to corrupt heap memory inside the LSASS process and elevate privileges to the level LSASS runs at (SYSTEM). The flaw carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning exploitation is local, low-complexity, requires no user interaction, and is confined to the same security scope, so it is a post-compromise escalation step rather than an initial access vector. At time of analysis there is no public exploit identified, CISA's SSVC assessment records Exploitation: none, and the issue is not listed in KEV; a vendor patch is available, so the practical priority is routine patch-cycle remediation rather than emergency response.
Code execution in Windows Cryptographic Services is possible when an authenticated attacker with valid low-privilege credentials and network reachability to the affected host wins a memory-lifecycle race in a freed object (use-after-free). Successful exploitation yields high confidentiality and integrity impact, but the high attack complexity (AC:H) means it depends on non-deterministic heap timing rather than a deterministic trigger, and the CVSS vector requires PR:L, so unauthenticated remote exploitation is not described. No public exploit has been identified at time of analysis, CISA SSVC records Exploitation=none and Automatable=no, and vendor patches are already available for every listed Windows client and server build.
Remote code execution in the Windows iSCSI initiator stack (CVE-2026-70013) allows a network-adjacent attacker to execute arbitrary code with high confidentiality, integrity and availability impact. Affected are the Windows iSCSI components shipped across Windows 10, Windows 11 (23H2 through 26H2) and Windows Server 2012 through Server 2025, including Server Core installations, with vendor fixes now published. Exploitation requires an active iSCSI session - typically a target the attacker controls or can inject responses into - and, because the flaw is a use-after-free race (CWE-416, AC:H), success depends on winning a memory-reuse timing window rather than issuing a single deterministic request; no public exploit code has been identified at time of analysis and CISA's SSVC assessment records Exploitation: none, so this is a serious-but-not-emergency priority rather than an active incident.
Use-after-free in the Windows Remote Desktop Client lets an unauthenticated attacker execute arbitrary code on a connecting client by luring a user into initiating an RDP session to an attacker-controlled or compromised server. The vector is network-reachable with no privileges required (PR:N), but practical exploitation depends on the victim starting the outbound connection (UI:R) and on the attacker winning a specific memory-state or timing condition (AC:H), which is consistent with CISA's SSVC rating of non-automatable and no observed exploitation. No public exploit code has been identified at time of analysis and Microsoft has published fixed builds covering all affected Windows 10, Windows 11 and Windows Server platforms; because the trigger is client-initiated rather than a passive listening service, the realistic delivery paths are malicious .rdp files, crafted links, or a hijacked RDP endpoint.
Local privilege escalation in Microsoft Windows NTFS (CVE-2026-70010) allows an authenticated, low-privileged user to corrupt kernel heap memory via crafted NTFS filesystem operations and elevate to SYSTEM. The flaw is a heap-based buffer overflow (CWE-122) in the in-kernel NTFS driver, rated CVSS 7.8 (HIGH) with the vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning the attacker must already hold a local foothold on the host but needs no user interaction and faces low attack complexity. Exploitation is not remotely reachable over the network, no public exploit code has been identified at time of analysis, and CISA's SSVC assessment records exploitation as 'none'; patch availability is confirmed through the Microsoft MSRC update guide.
A use-after-free (CWE-416) in the Microsoft Windows Remote Desktop Client allows an unauthenticated attacker to execute code on a victim's machine when that user initiates an outbound connection to an attacker-controlled RDP server. The flaw is client-side rather than a remotely reachable service bug: the attacker must control the server endpoint and also win a race condition inherent to the use-after-free (AC:H), while the victim must open a crafted .rdp file or otherwise accept the connection (UI:R), which is why the CVSS 3.1 base score sits at 7.5 even though a successful exploit yields full confidentiality, integrity and availability impact. Vendor-released patches are available, no public exploit code has been identified at time of analysis, and CISA's SSVC assessment records exploitation as none and automatable as no, so this is a moderate-priority issue rather than an urgent one.
Local privilege escalation in the Windows Storage Spaces Controller lets an authenticated low-privileged user corrupt kernel heap memory and gain execution at SYSTEM level, because the component fails to bounds-check attacker-influenced data (CVSS 7.8, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The affected surface is the Storage Spaces Controller present by default across Windows 10, Windows 11 and Windows Server 2012/2012 R2/2016/2019/2022/2025, including Server Core installations; patched builds (for example Windows 11 24H2 10.0.26100.9711, Windows Server 2025 10.0.26100.33650) are not exploitable. Exploitation is confined to a post-compromise scenario requiring an existing local foothold or valid low-privileged credentials, and no public exploit code has been identified at time of analysis; CISA's SSVC assessment records exploitation as 'none' and automatable exploitation as 'no', and the independent assessment rates this as credible but not emergency-priority.
Local privilege escalation in Microsoft's Windows Ancillary Function Driver for WinSock (afd.sys) lets an authenticated attacker who already has code execution on a target machine trigger a use-after-free in the kernel socket-handling paths and elevate to SYSTEM. The flaw is rated CVSS 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) - it is strictly local and requires a pre-existing foothold, and the race/timing nature of the bug makes it hard to trigger reliably, which is why CISA's SSVC rates exploitation as 'none' and automatable as 'no'. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so the risk is assessed as moderate rather than emergency priority; Microsoft has released fixes, with EUVD tracking the affected builds under EUVD-2026-99879.
Local privilege escalation in the Windows Win32 Kernel Subsystem lets an attacker who already holds authenticated, low-privileged access on a host trigger a use-after-free in kernel memory and gain elevated (SYSTEM-level) code execution. The assessed vector (AV:L/AC:H/PR:L/UI:N) shows exploitation is confined to the local machine and is gated by high attack complexity - the memory-reclamation or race timing makes reliable exploitation difficult and non-deterministic - with no user interaction and no remote or unauthenticated path. Microsoft has released vendor patches for every affected Windows 10/11 and Windows Server build, and no public exploit code or confirmed active exploitation has been identified at time of analysis (CISA KEV not listed; SSVC exploitation: none, automatable: no).
Local privilege escalation in the Windows Common Log File System (CLFS) driver lets an authenticated attacker who already holds low-privileged code execution on a Windows host trigger a heap-based buffer overflow in kernel mode and elevate to SYSTEM. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning no user interaction is required and attack complexity is low once a foothold exists, but it is not remotely reachable and cannot be triggered by luring a victim to open content. A vendor patch is available from Microsoft (per the MSRC update guide) and no public exploit code or confirmed active exploitation was identified at time of analysis, so this is a high-priority patch target for organizations that cannot fully prevent local code execution on endpoints and servers.
Local privilege escalation in the Windows Audio Service (audiosrv) lets an authenticated, low-privileged attacker who already has code execution on a Windows host corrupt memory and elevate to a higher-integrity context. The flaw is a use-after-free (CWE-416) rated CVSS 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H); the high attack-complexity value indicates the trigger likely depends on a race or a specific allocation/free timing window, making it unreliably repeatable rather than a one-shot exploit. Microsoft has published fixes through its update guide, and no public exploit code has been identified at time of analysis; the CVE was not listed in CISA KEV as of this assessment, so there is no confirmation of active exploitation.
Remote code execution against domain controllers running Active Directory Domain Services is achievable by an unauthenticated network attacker (CVSS 3.1: AV:N/PR:N/UI:N) who successfully bypasses an incorrect authorization check, yielding full confidentiality, integrity, and availability impact for a base score of 8.1. The practical constraint is the High attack-complexity rating: exploiting the flawed authorization decision requires an attacker-influenced condition such as a timing window, race, or particular directory state rather than a single deterministic request against a default configuration, and only hosts serving the AD DS role - not member servers or ordinary clients - are the realistic target. At time of analysis no public exploit identified and no confirmed active exploitation (no CISA KEV listing); vendor patch available, with EUVD-listed fixed build levels published.
Local privilege escalation in the Windows Desktop Window Manager (dwm.exe) allows an attacker who already holds an authenticated low-privilege account on the target host to exploit an out-of-bounds read and gain elevated (SYSTEM-level) code execution. All supported Windows 10, Windows 11, and Windows Server 2019/2022/2025 editions are affected up to their respective fixed builds, and the prerequisite is purely local code execution with no user interaction (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8). No public exploit code or confirmed active exploitation has been identified at the time of analysis and CISA SSVC rates exploitation as none and not automatable, so this is a routine patch-priority item rather than an emergency - but the vendor update should be applied promptly on multi-user, RDP-accessible, and privileged-administration endpoints where a local foothold is easiest to obtain.
Local privilege escalation in Microsoft's Windows Ancillary Function Driver for WinSock (AFD.sys) lets an attacker who already has low-privileged local code execution on a host obtain elevated (SYSTEM) rights by triggering a type confusion in the kernel driver. The flaw carries CVSS 7.8 (AV:L/AC:L/PR:L/UI:N), meaning the attack is local-only, needs valid low-level credentials or prior code execution, and requires no user interaction; AFD.sys is loaded by default on every supported Windows edition, so no non-default configuration is needed to reach the vulnerable code. It affects a broad set of Windows 10/11 and Windows Server 2012-2025 builds below the patched levels in EUVD-2026-99199; no public exploit identified at time of analysis, and CISA's SSVC assessment records exploitation as none with automatable set to no. This is a genuine patch-priority item but not an emergency.
Local privilege escalation in the Windows Console Driver (conhost/console driver component) allows an attacker who already holds authenticated local code execution on a Windows host to win a use-after-free race and gain high-integrity code execution, yielding full confidentiality and integrity impact (CVSS 3.1 base 7.0, AV:L/AC:H/PR:L/UI:N). Every supported Windows client and server branch is affected - from Windows Server 2012 through Windows Server 2025 and Windows 10 1607/1809/21H2/22H2 through Windows 11 23H2/24H2/25H2/26H1/26H2 - because the vulnerable console driver ships in the base OS. No public exploit has been identified at time of analysis and CISA's SSVC assessment rates exploitation as 'none' with automatable exploitation as 'no', so this is a moderate-priority local EoP hardening item rather than an internet-facing emergency; the practical limiting factors are the precondition of an existing local foothold (PR:L) and the high attack complexity of the memory-reuse race.
Local privilege escalation in Windows Shell allows an attacker who already holds a low-privileged, authenticated account on a Windows host to traverse relative paths and raise their privileges to a higher integrity level (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is not a remote or initial-access vector - it requires existing local code execution or account access, but needs no user interaction and is low-complexity once that foothold exists. CISA's SSVC assessment records no observed exploitation and no automatable path, and no public exploit has been identified at time of analysis; vendor patches are available, making this a credible but second-tier prioritization compared with actively exploited or remotely reachable issues.
Local privilege escalation in Windows Security Center lets an attacker who already holds a foothold on a Windows host with low-level privileges (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.0 High) abuse an improperly restricted communication channel to obtain high confidentiality and integrity impact on the same machine. Only hosts that have not yet applied the current cumulative builds are affected, spanning Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2016/2019 including Server Core installations. The high attack complexity indicates a non-trivial precondition - most consistent with a race or transient-state condition that must be won to redirect or spoof the endpoint - so reliability is limited; prior local access and valid credentials are mandatory and no public exploit identified at time of analysis, with no CISA KEV listing.
Privilege escalation in Windows OLE DB allows an unauthenticated remote attacker to elevate to SYSTEM by inducing a victim to open a crafted file or connect to an attacker-controlled data source that a vulnerable OLE DB provider parses, causing a heap-based buffer overflow (CWE-122). The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) confirms authentication is not required, but user interaction is mandatory - there is no zero-click network path, which is the main limiting factor. All default Windows installations are affected across Windows 10, Windows 11 (22H2 through 26H2) and Windows Server 2012 through 2025 including Server Core; there is no public exploit identified at time of analysis and CISA SSVC records exploitation as none, so this is a high-priority patch item rather than an emergency.
Local privilege escalation in the Windows Win32k kernel subsystem allows an authenticated, low-privileged attacker already running code on a Windows host to corrupt kernel memory and gain SYSTEM-level execution. The flaw is a use-after-free (CWE-416) reachable from a standard user context; per the assessed vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H it requires pre-existing local, authenticated access (PR:L, AV:L) with no remote or unauthenticated path, and the high attack complexity (AC:H) reflects the need to win a timing/race window and reliably reclaim the freed object, which lowers exploitation reliability. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); Microsoft rates it 7.0 (High) and has released fixes across all supported Windows 10, Windows 11, and Windows Server branches.
Remote code execution is possible on Windows hosts that have the Network Policy Server (NPS) role deployed, where an authenticated attacker with network reach to the service can trigger a heap-based buffer overflow (CWE-122) and potentially take over the NPS process (CVSS 7.5; CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Because NPS is the Windows RADIUS/802.1X authentication service and is not installed by default, exposure is effectively limited to servers functioning as RADIUS or NAP infrastructure, and the high attack complexity (AC:H) reflects the heap grooming typically required for reliable exploitation rather than an easily automated attack. There is no public exploit identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' with automatable 'no', and a vendor patch is available, so this is a genuine but not top-tier priority that should be handled in normal patch cadence.
Local privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) lets an authenticated attacker who already holds low-level code execution on a host raise privileges to SYSTEM on unpatched Windows 10, Windows 11, and Windows Server builds. The bug is a kernel type confusion (CWE-843) in an always-present, in-box WinSock component reachable by ordinary users through standard socket APIs, but exploitation is rated high-complexity (AV:L/AC:H/PR:L/UI:N) because a reliable trigger likely depends on winning a race or reaching a precise kernel object/memory state, which lowers real-world reliability. This is a genuine but moderate-priority local privilege-escalation issue: no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV), while Microsoft has published fixes through its standard update channel.
Local privilege escalation in Windows Push Notifications allows an attacker who already holds a low-privileged authenticated local session to gain SYSTEM-level code execution by exploiting a timing-dependent use-after-free (CWE-416), but the high complexity score (AC:H) and race-condition requirement make successful exploitation unreliable. Microsoft has released patches, and no public exploit has been identified at time of analysis. The flaw scores 7.0 CVSS and can lead to full confidentiality, integrity, and availability impact, yet the mandatory local access prerequisite makes it a genuine but not top-priority issue.
Windows PowerShell on supported Windows client and server editions fails to enforce a protection mechanism, letting a locally authenticated low-privileged attacker bypass a security feature and operate outside the intended security boundary, achieving high confidentiality, integrity, and availability impact (CVSS 8.8, scope-changed). Exploitation requires a pre-existing local foothold and the ability to run PowerShell on the host - there is no remote or unauthenticated path, and CISA's SSVC assessment rates exploitation as 'none' with Automatable=no, meaning the issue is not wormable or easily mass-scanned. There is no public exploit identified at time of analysis, though the technical impact is rated total once the prerequisite access is obtained; Microsoft has released fixes and the MSRC update guide is the authoritative remediation source.
Local privilege escalation in the Windows Search component affects every pre-patch build of supported Windows client and server editions, letting an attacker who already holds low-privileged local access execute code at a higher integrity level by exploiting a numeric truncation error in the search/indexing code path. Rated CVSS 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), the flaw requires local authenticated access (PR:L, AV:L) but no victim interaction (UI:N) and has low attack complexity, making it a post-compromise escalation primitive rather than a remote or initial-access vector. CISA's SSVC assessment records exploitation as 'none' and automatable as 'no', and no public exploit code has been identified at time of analysis; vendor patches are available from Microsoft.
Local privilege escalation in the Windows Win32k kernel subsystem (CVE-2026-70176) allows an authenticated attacker who already holds low-privileged local access on a host to elevate their privileges by triggering a use-after-free in kernel-mode code, rated CVSS 7.0 (High, AV:L/PR:L/AC:H/UI:N). The flaw sits in a component that is present by default in every supported Windows edition and cannot be disabled or removed, so no special configuration is required to reach the vulnerable code; the main obstacle for an attacker is the high attack complexity of the required free/reuse race, which lowers reliability and may force repeated attempts. Microsoft has published a vendor patch, there is no CISA KEV listing, and no public exploit code has been identified at time of analysis, though the ENISA EUVD record and MSRC advisory confirm a wide set of affected Windows 10, Windows 11, and Windows Server 2016-2025 (including Server Core) builds.
Local privilege escalation in Microsoft Windows NTFS lets an authenticated attacker who already has low-privileged code execution on the host escalate to kernel/SYSTEM level by driving the filesystem driver into an untrusted pointer dereference (CWE-822). The flaw is local-only (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) and affects every listed Windows 10, Windows 11 (23H2 through 26H2) and Windows Server 2012 through Server 2025 build below its patched revision, since NTFS is the default Windows filesystem and no non-default configuration is required. There is no public exploit identified at time of analysis and CISA SSVC rates Exploitation=none and Automatable=no; Microsoft has shipped vendor patches, making this a credible but not emergency-level priority.
Local privilege escalation in the Windows Connected Devices Platform Service (CDPSvc) affects a broad set of Windows 10, Windows 11, Windows Server 2019, 2022 and 2025 builds, allowing an attacker who already holds an authenticated low-privileged local account to raise their privileges to a higher integrity level. The flaw is a race condition (CWE-362) in which concurrent access to an improperly synchronized shared resource can be timed to corrupt service state; the narrow, hard-to-control timing window is reflected in the high attack complexity (AC:H) of the assessed CVSS 7.0 (High) vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning remote or anonymous exploitation is not possible and success likely requires repeated attempts. Vendor patches are available and no public exploit code has been identified at time of analysis; the service ships by default on supported editions, so exposure is limited mainly by the requirement for pre-existing local access.
Local privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows an authenticated, low-privileged attacker who already has local code execution on the host to corrupt kernel memory and elevate to SYSTEM by winning a timing-dependent use-after-free race in the socket subsystem. The flaw is rated CVSS 7.0 (AV:L/AC:H/PR:L/UI:N, total technical impact), requires no user interaction, and affects unpatched Windows 10, Windows 11, and Windows Server 2012 through 2025 builds, though exploitation is non-trivial and not automatable per CISA SSVC (Automatable: no). No public exploit code or confirmed active exploitation has been identified at time of analysis, and vendor-released patches are available for every affected build.
Local privilege escalation in the Windows TCP/IP stack allows an authenticated attacker who already holds low-privileged code execution on a host to corrupt kernel memory and elevate to a higher-integrity context. The flaw is a use-after-free (CWE-416) that requires winning a race condition (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.0), which limits reliability and keeps the flaw non-automatable per the CISA SSVC assessment; no public exploit code has been identified at time of analysis and exploitation has not been observed. Every supported Windows client and server edition, including Server Core installations, is affected until updated to the fixed builds published by Microsoft, and practical risk is concentrated on shared or multi-user hosts where untrusted users can run local code.
Denial of service in the OpenSSH server component (sshd) shipped as an optional feature of Windows allows an unauthenticated, remote attacker who can reach the SSH port to consume host resources without throttling, degrading or exhausting the service so legitimate SSH sessions can no longer be established. Only Windows builds that actually have the OpenSSH Server capability installed, enabled and network-reachable are at risk - the feature is not on by default for most client installs, which materially narrows the attack surface, and the impact is availability-only (C:N/I:N/A:H). The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5), CISA's SSVC assessment records exploitation as none, automatable as yes and technical impact as partial, and there is no public exploit identified at time of analysis; a vendor fix is available.
Local privilege escalation in the Windows kernel allows an authenticated attacker holding only low privileges on a vulnerable host to trigger a use-after-free (CWE-416) and gain code execution at higher integrity, with full confidentiality, integrity and availability impact per the CVSS vector (7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The attacker must already be logged on locally and no user interaction is required, but the high attack complexity means success depends on reliably reclaiming a freed kernel object, a timing-sensitive operation requiring build-specific memory-layout knowledge across the large set of affected Windows 10, Windows 11 and Windows Server builds below their fixed patch levels. No public exploit code or confirmed active exploitation was identified at time of analysis, and the CISA SSVC assessment records exploitation as 'none' and not automatable, making this a moderate-priority patch item rather than an emergency; vendor patches with explicit fixed build numbers are available via the Microsoft Security Response Center advisory.
Remote code execution in the Windows Routing and Remote Access Service (RRAS) affects Windows 10, Windows 11 and Windows Server 2012 through 2025 hosts on which the RRAS role is installed, with the CVSS 3.1 vector (8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicating a network-reachable attacker who already holds a low-privilege authenticated position, requires no user interaction, and can achieve full confidentiality, integrity and availability impact. The defect is a double free (CWE-415) memory-corruption condition in the service, which Microsoft has addressed in its monthly update with fixed builds published for each supported branch. There is no public exploit identified at time of analysis and no confirmed actively exploited (CISA KEV) status, and real-world exposure is materially narrowed because RRAS is not enabled by default on standard Windows installations.
Unauthenticated remote code execution is possible against the Windows System Information Console, where a heap-based buffer overflow (CWE-122) reachable over the network lets an attacker with no credentials and no user interaction run arbitrary code in the context of the affected component. Every supported Windows client and server build remains vulnerable until the vendor's security updates are applied - for example Windows 11 24H2 build 10.0.26100.9711, Windows Server 2025 build 10.0.26100.33650, and Windows Server 2016 build 10.0.14393.9612. Exploitation has not been observed (CISA SSVC exploitation: none) and no public exploit code is identified at time of analysis, but with CVSS 9.8, an automatable attack path, and total technical impact, the divergence between the severity signal and the quiet exploitation picture is the central risk consideration - the practical constraint is simply whether the affected component is network-reachable on a given host.
Local privilege escalation in the Microsoft Windows Search Component allows an attacker who already holds a low-privileged, authenticated session on a Windows host to trigger a use-after-free and escalate to SYSTEM-level code execution. Affected systems are Windows 10, Windows 11 (23H2, 24H2, 25H2, 26H1 and 26H2) and Windows Server 2012 through 2025 editions running builds below the fixed levels published for CVE-2026-70156; the component is enabled by default on all of them, so no non-default configuration is required. Rated CVSS 3.1 base 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), exploitation hinges on winning a race or achieving a precise heap-reuse state, which lowers reliability, and no public exploit identified at time of analysis. The only material prerequisite is existing local access, making this a post-compromise escalation and persistence primitive rather than a remote entry point.
A memory-leak flaw (CWE-401) in the Microsoft Windows DNS Server service lets an unauthenticated, remote attacker gradually exhaust server memory by sending repeated DNS queries, ultimately degrading or denying DNS resolution on affected hosts. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N with availability-only impact (A:H), no credentials or user interaction are required, and any default DNS-server deployment reachable on the network is exposed; however, this is a slow resource-exhaustion condition rather than an instantaneous crash, so the practical impact scales with sustained traffic and available memory. An independent assessment rates this as a genuine but second-tier priority: SSVC indicates no known exploitation, no publicly available exploit code has been identified at time of analysis, and a vendor patch is available, making timely patching the decisive control.
Remote code execution in the Microsoft PostScript Printer Driver on unpatched Windows client and server builds allows an unauthenticated attacker to corrupt heap memory (CWE-122) by delivering crafted PostScript content over the network to a reachable print path, yielding high confidentiality, integrity, and availability impact per the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N. The full set of supported Windows 10, Windows 11, and Windows Server branches (2012 through 2025, including Server Core installations) is affected at the build levels listed in the vendor advisory, so virtually every maintained Windows print host is in scope until updated. Despite the 9.8 base score, CISA's SSVC assessment records Exploitation as 'none' and no public exploit code has been identified at time of analysis, so this should be treated as a critical, patch-immediately issue rather than an actively exploited one; Microsoft has released fixing updates through the Security Update Guide (MSRC, mirrored as ENISA EUVD-2026-100162).
A use-after-free in the Microsoft Windows Search Component allows an authenticated local attacker with low privileges to elevate to SYSTEM-level code execution on affected Windows client and server builds. Exploitation requires the attacker to already be running code on the host and is constrained by high attack complexity (AC:H), consistent with winning a memory-reuse race in the search/indexing component that depends on precise timing and heap state and may need repeated attempts; no user interaction is required. This is a moderate-priority local privilege-escalation issue rather than an emergency: there is no public exploit identified at time of analysis, SSVC records Exploitation as 'none', and Microsoft has released fixes (vendor advisory https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70150).
A heap over-read in the Windows Client Side Caching driver (csc.sys) allows an attacker to disclose sensitive memory contents, affecting Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025 builds prior to the vendor's fixed revisions. Microsoft's advisory carries a CVSS 8.8 score with a network, user-interaction vector (AV:N/PR:N/UI:R), whereas the independent assessment bounds the flaw to an authorized attacker who already holds local access on the host (AV:L/PR:L/UI:N) - a material conflict that should be resolved against the vendor advisory before prioritization. Vendor patches are available and no public exploit code has been identified at time of analysis; CISA's SSVC record lists exploitation as 'none' and automatable as 'no', and no EPSS score was supplied.
Remote code execution is possible in the Microsoft PostScript Printer Driver, where a heap-based buffer overflow (CWE-122) lets an unauthenticated attacker who can deliver crafted PostScript print data over the network corrupt heap memory and execute arbitrary code in the context of the Windows Print Spooler. The flaw carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no authentication and no user interaction are required; every supported Windows client and server release from Windows Server 2012 through Windows 11 26H2 and Windows Server 2025 is affected unless it has been updated to the fixed build listed by Microsoft. Vendor patches are available, and no public exploit code or active exploitation has been identified at time of analysis - SSVC records exploitation as 'none' - so the practical exposure is driven by whether the print/spooler service is reachable from untrusted networks.
A heap-based buffer overflow in the Windows Network File System (NFS) Server role lets an attacker who already holds local, low-privileged authenticated access on a Windows host execute code in a higher-privileged context, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base 7.8, AV:L/PR:L/UI:N). Exploitation is constrained by prerequisites: the optional NFS Server / Services for NFS feature must actually be installed and enabled - it is absent from default Windows installations - and the attacker must already be on the box with valid low-privilege credentials; no user interaction is required. Vendor-released patches exist for all listed Windows client and server builds, no public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV), so this is a moderate-to-serious patching priority rather than a top-tier emergency. Defenders should note the scoring discrepancy flagged in the independent assessment: NFS is a network-facing service, yet Microsoft scored the vector as LOCAL - confirm via the MSRC advisory whether any network-adjacent trigger path exists beyond the local vector.
Local privilege escalation in the Windows Audio Service lets an attacker who already holds low-privilege code execution on a Windows host trigger a use-after-free (CWE-416) and elevate to a more privileged context. The flaw is rated CVSS 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H): it is not remotely reachable, requires an existing foothold and local code execution, and the high attack complexity reflects a race/timing window that must be won, making exploitation non-deterministic. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as none and non-automatable, and the issue does not appear in CISA KEV; completely patched builds are available from Microsoft.
Local privilege escalation in the Windows Update Service lets an authenticated attacker with low-level local access (CVSS PR:L/AV:L) corrupt heap memory to gain SYSTEM-level code execution on unpatched Windows client and server builds. The flaw is a heap-based buffer overflow (CWE-122) that requires no user interaction and no special configuration, since the Windows Update Service is enabled by default; exploitation cannot be automated or performed remotely, and no public exploit code or active exploitation has been identified at time of analysis.
Local privilege escalation in Microsoft Windows OLE allows an attacker who already holds low-privileged authenticated access on a host to drive a heap-based buffer overflow by inducing the vulnerable component to process a crafted OLE object, resulting in code execution at a higher integrity level with complete loss of confidentiality, integrity, and availability (CVSS 7.8, CWE-122). The issue spans a wide set of unpatched Windows client and server builds, including Windows 10 21H2/22H2, Windows 11 23H2 through 26H2, and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025; vendor fixes are available and no public exploit code was identified at time of analysis. Because the attack is local (AV:L), requires existing credentials (PR:L), needs no victim interaction (UI:N), and is classified as non-automatable with exploitation 'none' under CISA's SSVC framework, it is a second-tier, post-compromise escalation primitive rather than a remote or wormable threat.
Local privilege escalation in the Microsoft Windows Search component lets an authenticated attacker with a low-privileged local account corrupt memory and potentially execute code at a higher integrity level. The flaw is a use-after-free (CWE-416) rated CVSS 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning exploitation is local, requires prior authentication, needs no user interaction, and carries high attack complexity because the attacker must reliably reclaim a freed object. Microsoft has released vendor patches; no public exploit code has been identified, and CISA's SSVC assessment records exploitation as none with the issue not automatable (technical impact: total).
Local privilege escalation in the Windows Event Tracing (ETW) subsystem allows an attacker who already holds low-privileged code execution on a host to raise their privileges, with high confidentiality, integrity and availability impact (CVSS 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The root cause is a use-after-free (CWE-416) that is only reachable locally and additionally requires winning a timing race, so reliable exploitation is non-trivial; no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, with CISA SSVC scoring exploitation as 'none' and automatable as 'no'. Microsoft has released a vendor patch, and risk is concentrated on multi-user, terminal/RDP, or shared systems where untrusted low-privilege accounts can run code - a moderate, not emergency, priority.
Network denial of service in Windows SMB Server allows unauthenticated remote attackers to make the service allocate resources without throttling, exhausting memory or handles until SMB-dependent services and, potentially, the host become unresponsive. Tracked as CWE-770 and scored 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), it affects Windows 10 (1607 through 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1/26H2) and Windows Server 2012 through Server 2025, with impact confined to availability - there is no disclosure or code-execution path. No public exploit has been identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' (automatable: yes, technical impact: partial), and vendor-released patches are available through the Microsoft update guide referenced by the advisory.
Local privilege escalation in the Windows Portable Device File System Driver lets an authenticated, low-privileged attacker who already has code execution on a Windows host trigger a heap-based buffer overflow (CWE-122) and elevate to SYSTEM. The flaw spans an unusually wide set of builds - Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025, including Server Core installations - and carries a vendor CVSS of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Microsoft has released fixes, CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', and no public exploit code has been identified at time of analysis; the operative constraint is the required local foothold, which makes this a second-stage escalation primitive rather than an entry point.
Heap-based buffer overflow in Microsoft Windows Media Foundation allows a local attacker to elevate privileges on affected Windows hosts by supplying a crafted media file that the logged-in user opens, previews, or otherwise has parsed by the platform's media pipeline. Successful exploitation is assessed at CVSS 3.1 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, CWE-122), yielding high confidentiality, integrity, and availability impact; because the vector is local with a user-interaction prerequisite, the attacker must first land the file on the target and induce the user to process it, which makes this a credible but interaction-gated escalation path rather than a network-facing exploit. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV); a vendor patch is available, and fully updated builds (those at or above the version thresholds enumerated in the EUVD affected-version data) are not affected. Despite being an LPE rather than an RCE, the no-privilege prerequisite, low complexity, and full three-property impact keep this a legitimate prioritization candidate in environments where media files are routinely handled.
Unauthenticated remote code execution in the Windows DNS Server role stems from a use-after-free (CWE-416) that lets an attacker who can reach the service over the network run code in the context of the DNS service. All supported Windows Server generations carrying the DNS role are affected - 2012, 2012 R2, 2016, 2019, 2022 and 2025 (including Server Core), plus Windows 10 1607 and 1809 where the role is installed - while hosts without the DNS Server role are not exposed. The practical risk is tempered by high attack complexity (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, 8.1), since reliable exploitation depends on winning a race or landing a specific heap state; no public exploit identified at time of analysis, CISA SSVC records Exploitation: none and Automatable: no, and a vendor-released patch is available - making this serious but not emergency-tier.
Memory-safety failure in the Windows Bluetooth Port Driver lets a device within Bluetooth radio range trigger out-of-bounds memory access that can escalate to code execution on unpatched Windows 10, Windows 11, and Windows Server hosts with an active Bluetooth radio. Exploitation requires proximity (adjacent network), the victim's Bluetooth to be enabled and in use, some form of user interaction such as accepting or initiating a Bluetooth connection, and high attack complexity reflecting preconditions outside the attacker's control; authentication is not required (CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H). Microsoft has shipped fixes, no public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as "none" with the attack assessed as non-automatable, and hosts with Bluetooth disabled are not exposed - making this a moderate rather than top-tier priority despite the 7.1 score and the CVSS "total" technical impact rating on affected devices.
Local privilege escalation in the Microsoft Graphics Component affects multiple Windows client and server builds, allowing a local, authenticated attacker with low privileges (CVSS AV:L/PR:L) to exploit a numeric truncation error and gain High confidentiality, integrity, and availability impact after corrupting heap memory. The vulnerability has a CVSS 3.1 base score of 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), requires no user interaction, and is not a remote entry point; no public exploit was identified at time of analysis, and no EPSS score was provided. A vendor patch is available per Microsoft, so affected organizations should prioritize update deployment on all listed Windows versions and Server Core installations.
Local privilege escalation in the Windows Kernel allows an authenticated low-privilege attacker with existing code execution on a target host to trigger a heap-based buffer overflow and elevate privileges in kernel mode. Affected default installations include Windows 10, Windows 11 21H2 through 26H1, and Windows Server 2019/2022/2025 builds below the vendor-patched build levels. No public exploit identified at time of analysis and CISA SSVC reports no exploitation; a vendor patch is available.
Heap-based buffer overflow in the Windows Win32 Kernel Subsystem allows an authenticated local attacker holding only standard user rights to corrupt kernel heap memory and elevate to full SYSTEM-level privileges on unpatched Windows hosts. The vulnerability is strictly local (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) and affects a very broad install base, spanning Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2016 through 2025, so it functions as a reliable post-compromise escalation primitive rather than an initial-access emergency. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records Exploitation: none, and the CVE is not listed in KEV; Microsoft has released vendor patches with fixed servicing builds for every affected branch.
Local privilege escalation in Microsoft's Windows Client for NFS allows an authenticated low-privileged attacker who already has code execution on a host to elevate to higher privileges (assessed CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.8). Exploitation requires the optional 'Client for NFS' feature to be installed and reachable from the attacker's context, so default installations without that component are not affected, and there is no remote or network-facing attack path. CISA's SSVC assessment records exploitation as 'none' and no public exploit code has been identified at time of analysis; Microsoft has released fixes via its update guide (MSRC advisory for CVE-2026-70113), and the issue is tracked as CWE-190 integer overflow or wraparound.
Heap-based buffer overflow in the Microsoft Windows Storage Spaces driver (Spaceport.sys) allows an authenticated, low-privileged local user to execute code in kernel context and elevate privileges, carrying a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The attacker must already hold a session on the target host, so this is best treated as a post-compromise privilege-escalation step rather than a remote entry point, and no user interaction is required beyond the existing local session. Vendor-released patches exist for all affected Windows 10, Windows 11 and Windows Server builds; no public exploit code has been identified at time of analysis and CISA's SSVC assessment records exploitation as "none". Compared with network-facing, pre-authentication bugs this rates as a credible but not emergency-tier priority: patch it on a normal cycle, but prioritize systems where untrusted or low-privileged users can obtain local interactive sessions.
Elevation of privilege in the Microsoft Windows Kernel lets an unauthenticated, remote attacker who can reach the affected kernel code path corrupt or redirect kernel memory and gain SYSTEM-level control of the target host. All currently supported Windows client and server families are in scope - Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations - and the assessment vector (AV:N/AC:H/PR:N/UI:N, C:H/I:H/A:H, base 8.1) confirms no credentials or user interaction are needed. The decisive limitation is attack complexity: the attacker must control or influence an untrusted pointer and win a precise kernel memory-layout or timing condition, so this is not a single-shot request. Microsoft has published a fix and there is confirmed vendor patch availability, but no CISA KEV listing and no public exploit code identified at time of analysis; the practical verdict is a genuine high-priority patching candidate rather than a drop-everything emergency.
Local privilege escalation in the Microsoft PostScript Printer Driver allows a low-privileged user on an affected Windows host to gain elevated code execution by having attacker-controlled PostScript/print-driver data processed on the machine, with the root cause classified as a CWE-121 stack-based buffer overflow and a CVSS base score of 7.8. The vector (AV:L/AC:L/PR:N/UI:R) shows no privileges are required prior to exploitation (PR:N) but local presence is mandatory and the victim must be induced to trigger processing of the malicious data (UI:R); CISA's SSVC assessment records Exploitation=none and Automatable=no, and no public exploit code has been identified at time of analysis. This is a credible but context-dependent post-compromise escalation step rather than a mass-exploitation emergency, and a vendor patch is available.
A heap-based buffer overflow (CWE-122) in the Microsoft PostScript Printer Driver lets a local attacker who persuades a victim to process a crafted PostScript print job or document elevate privileges on affected Windows client and server releases. The flaw requires local access (AV:L) and user interaction (UI:R) but no prior privileges (PR:N), so it is a targeted rather than opportunistic local privilege-escalation vector; CISA SSVC rates it non-automatable with no observed exploitation, and no public exploit code has been identified at time of analysis. Vendor patches are available and, per the assessed impact (C:H/I:H/A:H), successful exploitation gives full code execution in the driver's higher-privileged context.
Heap-based buffer overflow in the Windows Win32 kernel subsystem lets a locally authenticated low-privilege attacker escalate to full system privileges on an affected host. Every supported Windows build in the EUVD-listed ranges is exposed by default - Windows 10 21H2 and 22H2, Windows 11 23H2 through 26H2 (including 26H1), and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 in both full and Server Core installations - until the corresponding cumulative update is applied; CVSS 3.1 is 7.8 (AV:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so impact on confidentiality, integrity and availability is total once the primitive is triggered. Microsoft has published fixes in its update guide, and no public exploit code or active exploitation has been identified at time of analysis (CISA SSVC exploitation: none). The practical barrier is that the attacker must already hold local code execution on the target, making this a post-compromise privilege-escalation step rather than an initial-access vector.
Heap-based buffer overflow in the Windows kernel (CVE-2026-70106) allows an attacker who already holds low-privileged local code execution to elevate privileges on the affected host, scoring 7.8 under CVSS v3.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exposure is broad across build numbers - Windows 10, Windows 11 and Windows Server 2012 through 2025, including Server Core - but the attack is gated behind an existing local foothold, so it is a post-compromise escalation primitive rather than a remotely reachable one. Microsoft has released fixes through the MSRC update guide, and no public exploit code or confirmed active exploitation was identified at time of analysis (CISA SSVC exploitation: none).
Local privilege escalation in the Windows Win32 Kernel Subsystem lets an attacker who already holds low-privileged, authenticated code execution on a Windows host raise their privileges to kernel level. The flaw is an untrusted pointer dereference (CWE-822) in the kernel that can be triggered with low attack complexity and no user interaction, giving high impact to confidentiality, integrity, and availability (CVSS 3.1 7.8, AV:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No public exploit code has been identified and CISA's SSVC assessment records exploitation as none and automatable as no, so this is a credible but not emergency-level priority; the main constraint on attackers is the need for a pre-existing local foothold on an unpatched build.
Heap-based buffer overflow in Microsoft Windows Error Reporting (WER) lets a locally authenticated attacker holding only low-level privileges elevate their privileges on the host, with full confidentiality, integrity and availability impact (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No user interaction or non-default configuration is required because WER is a built-in subsystem present across every affected Windows 10, Windows 11 and Windows Server 2016-2025 SKU, but the flaw is not remotely exploitable: the attacker must already be able to run code locally under a valid low-privilege account. There is no confirmed active exploitation (the CVE is not in CISA KEV) and no public exploit code identified at time of analysis; Microsoft has published a fix and an advisory entry for the issue, so affected builds below the fixed thresholds should be updated.
Local privilege escalation in the Microsoft Windows Storage Spaces driver (Spaceport.sys) lets an authenticated, low-privileged attacker who already has code execution on a host corrupt kernel memory and obtain SYSTEM-level rights. The defect is a use-after-free (CWE-416) that is locally reachable with low attack complexity and no user interaction, and it affects Windows 10, Windows 11 and Windows Server builds below the fixed versions enumerated in the vendor update. No public exploit code has been identified and CISA's SSVC decision data records no exploitation activity, so this is a genuine but second-tier patching priority relative to any actively exploited issue in the same release cycle.
Heap-based buffer overflow in the Windows iSCSI Initiator component allows a remote unauthenticated attacker to execute arbitrary code on affected Windows 10, Windows 11, and Windows Server 2012 through 2025 systems, provided the target actually uses iSCSI and a user or administrator initiates or accepts a connection to an attacker-controlled iSCSI target (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.5). The user-interaction requirement and High attack complexity - the attacker must also satisfy memory-layout or timing conditions to convert the overflow into reliable code execution - sharply limit the practical attack surface to environments that deploy iSCSI storage. Vendor-released patches are available from Microsoft, CISA's SSVC decision framework rates exploitation as none and automatable as no, and no public exploit identified at time of analysis.
Local privilege escalation in the Windows Rich Text Edit Control (the riched20/msftedit engine used by WordPad, Outlook, and many applications that render Rich Text Format content) lets an attacker who already holds authenticated low-privileged access on a Windows host trigger a heap-based buffer overflow and obtain higher-integrity code execution. Exploitation requires the attacker to invoke the control with attacker-controlled rich-text content (CVSS PR:L, UI:N), so it is a post-compromise escalation primitive rather than a remote or unauthenticated path; SSVC rates the technical impact as total but flags the issue as not automatable, meaning reliable mass exploitation is unlikely, and no public exploit was identified at time of analysis. Microsoft has published a vendor fix, so the residual risk is concentrated on unpatched Windows 10, Windows 11, and Windows Server builds where a low-privileged foothold already exists.
Local privilege escalation in the Microsoft PostScript Printer Driver allows an attacker who gets a victim to open or print a crafted PostScript payload to trigger a heap-based buffer overflow (CWE-122) and execute code in the context of the affected Windows printing component. The flaw affects a broad range of Windows client and server builds - including Windows 10/11 and Windows Server 2012 through 2025 - that have not been updated to their fixed build revision. Per the CVSS vector the attacker needs no pre-existing account (PR:N), but exploitation is local (AV:L) and requires user interaction (UI:R), a crafted document must be processed on the target, and no public exploit code or active exploitation was identified at time of analysis (CISA SSVC: Exploitation = none, Automatable = no).
Heap-based buffer overflow in Microsoft Windows GDI (CWE-122) lets remote attackers achieve code execution on a fully updated-adjacent target by convincing a user to open or preview a maliciously crafted image or document that is parsed through the Windows Graphics Device Interface; the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (8.8) indicates no authentication is needed but that the victim must interact with the attacker-supplied file. Code execution occurs in the security context of the user who opened the file, so the impact is bounded by that user's privileges and no scope change occurs. No public exploit code has been identified at time of analysis and the CISA SSVC decision framework records Exploitation: none with Automatable: no, while Technical Impact is rated total; there is no KEV listing, so this is a high-priority patching item rather than an emergency. Microsoft has published fixed builds covering Windows 10, Windows 11 and Windows Server 2012 through 2025.
Local privilege escalation in Microsoft's Windows Search Component lets an authenticated attacker who already holds a low-privileged session on a Windows host trigger a use-after-free and elevate to a more privileged security context on the same machine. Exploitation is constrained by a high attack complexity rating (AC:H), reflecting a race/timing condition on the freed object that must be won reliably, and the vector (AV:L/PR:L/UI:N) confirms the attacker must already be logged in locally with low privileges; there is no remote attack surface and no victim interaction required. Patches are available from Microsoft (fixed builds such as Windows 11 24H2 10.0.26100.9711 or later), CISA's SSVC assessment records exploitation as none and the issue as not automatable, and no public exploit code has been identified at time of analysis.
Denial of service in the Windows DNS Server role allows an unauthenticated remote attacker to take DNS name resolution offline on affected Windows Server hosts by sending a crafted request that drives the service into an unhandled exception. Impact is limited to availability (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) with no confidentiality or integrity loss, and no public exploit was identified at time of analysis (CISA SSVC Exploitation: none, though the bug is rated Automatable: yes). Any Windows Server 2012, 2012 R2, 2016, 2019, 2022 or 2025 system - including Server Core installations - that runs the DNS Server role and is reachable on its DNS listening port is exposed; internal resolvers behind firewalls are materially less at risk than internet-facing ones.
Unauthenticated remote attackers who can reach a Windows DNS Server over UDP/TCP 53 can drive the service into a denial-of-service state on affected Windows Server 2012 through 2025 (including Server Core) and Windows 10 1607/1809 builds. The defect is a workflow/state-enforcement logic flaw rather than memory corruption, and the assessed impact is availability-only (C:N/I:N/A:H), which produces the CVSS 3.1 base score of 7.5 with PR:N, AC:L and UI:N. No public exploit identified at time of analysis, and CISA's SSVC rates exploitation as none while marking the issue automatable, so it is a credible but second-tier priority; Microsoft has released fixes in the monthly Windows security update.
Stack-based buffer overflow in Windows DHCP Server allows an authenticated attacker with low-level network privileges to run arbitrary code on unpatched Windows Server and Windows 10 systems where the DHCP Server service is present. The flaw is network-reachable, low-complexity, and needs no user interaction, but PR:L means the attacker must already have an authenticated foothold; CISA SSVC rates exploitation as none and not automatable, and no public exploit code is identified at time of analysis. Vendor patches are available, making this a serious flaw to prioritize on exposed DHCP servers rather than an immediate emergency.
Privilege elevation on unpatched Windows hosts is possible through a heap-based buffer overflow (CWE-122) in the Client-Side Caching (CSC) / Offline Files service, which caches content fetched from SMB network shares. The assessed vector (AV:N/AC:L/PR:N/UI:R) describes an unauthenticated remote attacker, but success hinges on a victim interacting - typically by connecting to or accessing an attacker-controlled share so CSC parses a crafted response and overflows a heap buffer - which is consistent with SSVC rating automatic exploitation as 'no' and with the SSVC exploitation signal of 'none'. Microsoft has released patches for every affected build, and no public exploit code has been identified at time of analysis, so this is a serious but not emergency-grade issue demanding prompt, scheduled patching rather than crisis response.
Local privilege escalation to SYSTEM in the Windows Win32k kernel subsystem affects Windows 10, Windows 11, and Windows Server releases, allowing an authenticated low-privileged attacker already executing code on the host to exploit a use-after-free (CWE-416) condition and gain full kernel-level control (CVSS 3.1 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The high attack complexity (AC:H) reflects the need to reliably win a race or groom the kernel heap, and there is no remote or network vector, so multi-user, RDP/terminal-server, and kiosk systems are the most relevant risk surface. No public exploit code or active exploitation has been identified at time of analysis.
Local privilege escalation in Windows DHCP Server lets an authenticated, low-privileged user trigger a use-after-free (CWE-416) in the DHCP Server service and obtain SYSTEM-level code execution on the host. It is rated CVSS 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning the attacker must already have local access and must win a non-deterministic race to reach the freed-memory window, so the flaw is not remotely reachable and is best treated as a post-compromise escalation step on provisioned DHCP infrastructure rather than an emergency. No public exploit identified at time of analysis, CISA SSVC records Exploitation: none and Automatable: no, and vendor patch is available per the Microsoft advisory.
Integer underflow in the Windows Kerberos authentication component allows a locally authenticated attacker to elevate privileges on an affected host, giving full control over confidentiality, integrity, and availability of the machine. Exploitation requires a prior foothold: the attacker must already hold a valid low-privileged local account (PR:L, AV:L), and no user interaction is needed once that access exists; the flaw is not remotely reachable and SSVC rates it non-automatable, so it cannot be driven at mass or wormable scale. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV), but a vendor patch is available from Microsoft and should be applied to the extensive list of affected Windows 10, Windows 11, and Windows Server builds.
Memory corruption in the libarchive component bundled with Windows (the library behind tar.exe/bsdtar) lets a remote, unauthenticated attacker execute code on affected hosts by having them process a maliciously crafted archive. The root cause is a double free (CWE-415) during archive parsing that corrupts the heap, and because reliably converting that corruption into code execution requires precise heap grooming, Microsoft and our own assessment both rate attack complexity as High despite a CVSS base score of 8.1. No public exploit code has been identified at time of analysis, CISA's SSVC decision framework records exploitation as none and automatable as no, and vendor patches are already available for every affected Windows 10, Windows 11 and Windows Server branch, so this is a serious-but-not-emergency issue that should be closed on a normal patch cadence. One caveat: Microsoft's vector lists UI:N (no user interaction) while our independent assessment uses UI:R, since in interactive deployments a user or application typically has to initiate extraction of the hostile archive - an unattended/service context is where the impact is highest.
Local privilege escalation in the Microsoft Windows Win32 kernel subsystem allows an attacker who already holds low-privilege local access on a Windows host to corrupt heap memory and gain SYSTEM-level code execution. The flaw is a heap-based buffer overflow (CWE-122) rated CVSS 7.8 with a vector of AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning the attacker must be authenticated locally (PR:L, AV:L) and needs to run a crafted program that reaches the vulnerable kernel code path, with no user interaction required. There is no public exploit identified at time of analysis, CISA's SSVC assessment records Exploitation=none and Automatable=no, and vendor-released patches are available for all affected Windows client and server builds.
Local privilege escalation in Microsoft Windows OLE allows an authenticated attacker who already holds a low-privileged foothold on a host to corrupt heap memory through crafted OLE object handling and execute code at a higher integrity level, matching the assessed CVSS:3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8). Scope is limited to unpatched Windows 10, Windows 11 and Windows Server 2012 through 2025 builds listed by EUVD; because the vector is local-only with PR:L, the flaw is not remotely reachable and cannot be triggered against a default configuration by an outside party. CISA SSVC rates exploitation as "none" and automatable as "no", there is no public exploit identified at time of analysis, and Microsoft has shipped fixes via its Update Guide, making this a credible but not emergency-level priority.
Memory corruption in the Microsoft Windows DHCP Server role allows unauthenticated remote attackers to execute arbitrary code on affected servers over the network. Only systems with the DHCP Server role installed and running are exposed - the attack surface is the DHCP service itself (typically UDP 67), while ordinary Windows clients and servers without that role are not vulnerable. Affected builds span Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 (including Server Core installations) as well as Windows 10 versions 1607 and 1809 below the listed patch levels. No public exploit code has been identified at time of analysis, and CISA's SSVC assessment records no observed exploitation and a non-automatable attack profile, although technical impact is rated total; a vendor patch is available. Note that the vendor-published base vector (7.5) reflects an availability-only impact, whereas the independent assessment scores confidentiality, integrity and availability all High (full code execution).
Local privilege escalation in the Windows Update Service allows an attacker who already possesses valid low-privileged local access on an affected Windows host to elevate to a higher-integrity context (including SYSTEM) by triggering a use-after-free. The attack is entirely local - there is no network-facing path - and the assessed vector (AV:L/AC:H/PR:L/UI:N) means successful exploitation depends on winning a race/timing window inherent to the memory-reuse condition, so reliable elevation may require multiple attempts and is not a deterministic one-shot. Affected unpatched builds span Windows 10 21H2/22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2019/2022/2025 (Server Core included); no public exploit code has been identified at time of analysis and there is no CISA KEV confirmation of active exploitation, making this a legitimate but moderate-priority LPE rather than an urgent, broadly exploited threat.
Heap-based memory corruption in the Windows NetBIOS component lets an authenticated local attacker with only low-privileged code execution elevate to SYSTEM on unpatched hosts. Exploitation requires an existing foothold - a valid local account and the ability to run code on the target - so this is a post-compromise escalation primitive, not a remote or initial-access vector; no user interaction is required (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8). Microsoft has released fixes and CISA's SSVC assessment rates exploitation as 'none' and the issue as non-automatable, so despite a total technical impact this rates as a genuine but not emergency-tier priority; no public exploit code was identified at time of analysis.
Local privilege escalation in Windows SmartScreen allows an attacker who already holds a low-privileged interactive session on a Windows host to corrupt memory through a type-confusion condition and elevate to a higher-integrity context, with full loss of confidentiality, integrity, and availability if successful. Exploitation is local only (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8): there is no remote or network vector, and the attacker must first establish code execution on the target before triggering the flaw. Microsoft has released fixes, and CISA's SSVC review rates exploitation as none observed and not automatable, so this is best treated as a manual post-compromise escalation step rather than a mass-exploitation threat; no public exploit code or KEV listing is associated with the CVE at time of analysis.
A heap-based buffer overflow in the Windows Resilient File System (ReFS) driver (refs.sys) allows a locally authenticated, low-privileged attacker to corrupt kernel heap memory and elevate privileges to SYSTEM on affected Windows 10, Windows 11, and Windows Server builds. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and requires the attacker to already have a foothold on the host plus the ability to feed attacker-controlled input through the ReFS code path, which in practice means a ReFS-formatted volume must be present or mounted for the driver to process that input. Vendor patches are available per the Microsoft advisory, and no public exploit code has been identified at time of analysis (SSVC: Exploitation none, Automatable no); CISA's SSVC framing rates technical impact as total if successfully triggered, but the local-only, authenticated prerequisite and the non-default status of ReFS keep real-world urgency moderate.
Local privilege escalation in Windows Work Folders allows an attacker who already holds authenticated, low-privileged access on an affected Windows 10, Windows 11, or Windows Server host to trigger a use-after-free in the Work Folders code path, corrupting memory and potentially executing code with elevated privileges. The independently assessed vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0) confirms this is a post-compromise escalation step that requires an existing local foothold and a reliably won race/timing window, with no user interaction; there is no public exploit identified at time of analysis and CISA's SSVC assessment records exploitation as none and automatable as no. Microsoft has released fixed builds through the MSRC update guide, so the primary risk is to unpatched hosts where the Work Folders feature is present and in use.
Remote code execution in the Microsoft Windows iSCSI Initiator component (reported against Windows releases carrying the affected MSiSCSI/iSCSI code path) allows an unauthenticated, remote attacker to corrupt heap memory and execute arbitrary code in the context of the iSCSI service by driving a crafted iSCSI protocol exchange against the target. The flaw is a memory-safety defect (reported as a use-after-free, with vendor metadata also flagging buffer/heap overflow and denial-of-service characteristics) reachable from CVSS vector AV:N/AC:H/PR:N/UI:N, so no credentials or user interaction are needed and impact is scored C:H/I:H/A:H - full confidentiality, integrity and availability loss on the host. Exploitation is gated by prerequisites rather than by authentication: the victim host must have the iSCSI Initiator running and must establish a session with an attacker-controlled or spoofed iSCSI target, and the AC:H rating reflects a race/timing condition (or protocol state dependency) the attacker must win reliably. No public exploit code and no confirmed active exploitation (no CISA KEV listing) were identified at time of analysis, so this should be prioritized on exposure and asset criticality rather than on observed in-the-wild activity.
Unauthenticated network traffic against the Remote Desktop Gateway (RD Gateway) role service on unpatched Windows Server builds causes a memory leak that is never released, progressively exhausting server memory until the gateway can no longer broker remote desktop sessions (CWE-401, CVSS 7.5, availability-only). Only hosts where the RD Gateway role service is installed, running, and reachable over the network are affected - typically internet-facing servers listening on TCP 443 - while servers without that role are not in scope. CISA's SSVC assessment records Exploitation: none and Technical Impact: partial, with Automatable: yes, and no public exploit has been identified at time of analysis; a vendor patch is available, so exposure is bounded to the enumerated pre-patch build ranges.
Heap corruption in the Microsoft Windows iSCSI service lets an unauthenticated remote attacker crash or destabilize the service, yielding a denial-of-service condition on any host that has the iSCSI listener enabled and network-reachable. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms network reachability with no credentials, no user interaction, and no non-default configuration beyond the service being turned on, and the impact is confined to availability with no data disclosure or modification. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS or CISA KEV signal was supplied; exposure is therefore driven primarily by deployment, since hosts that do not run the iSCSI service or that firewall its port are not reachable.
Use-after-free in Windows Secure Kernel Mode allows an authenticated attacker running code locally on the target with low/standard-user privileges to escalate to higher privilege levels on affected Windows 10, Windows 11 and Windows Server 2019-2025 builds that are below their patched versions. The flaw is rated CVSS 7.0 (HIGH); no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis, and exploitation is gated by high attack complexity because a reliable UAF typically requires winning a timing race or precisely grooming Secure Kernel memory. Microsoft has released vendor patches - applying the fixed builds removes the condition entirely.
Remote unauthenticated code execution affects Microsoft Internet Information Services (IIS) on Windows: a stack-based buffer overflow in a request-handling parsing path is reachable over the network by anyone who can send crafted input to a running IIS instance. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) indicates no authentication, no user interaction, and no prior privileges are needed, and a successful exploit yields full loss of confidentiality, integrity, and availability on the host. No public exploit code was identified at time of analysis and there is no CISA KEV listing, but the combination of low attack complexity and unauthenticated network reachability makes this a high-priority item for any internet-facing IIS deployment; version and build specifics must be confirmed from Microsoft's advisory, since no CPE or version detail is provided in the available intelligence.
Local privilege escalation in Microsoft Windows Hyper-V lets an authenticated, low-privileged attacker who already has code execution on a host with the Hyper-V role enabled trigger a use-after-free in a Hyper-V component and gain SYSTEM-level code execution (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N/S:U with C:H/I:H/A:H). Affected builds span Windows 10 1809/21H2/22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2019, 2022, and 2025 including Server Core installations; no public exploit code has been identified at time of analysis and CISA SSVC records exploitation as none with Automatable: no, so risk is concentrated on multi-tenant, shared, or virtualization hosts where untrusted low-privilege principals already run. Microsoft has released fixes through the standard Windows cumulative update channel (MSRC advisory CVE-2026-70023, mirrored in ENISA EUVD-2026-100338), and administrators of Hyper-V hosts should treat this as a priority local escalation patch rather than a remote emergency.
Local privilege escalation in the Windows Local Security Authority Subsystem Service (LSASS) allows an authenticated attacker with an existing low-privileged foothold on a host to corrupt heap memory inside the LSASS process and elevate privileges to the level LSASS runs at (SYSTEM). The flaw carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning exploitation is local, low-complexity, requires no user interaction, and is confined to the same security scope, so it is a post-compromise escalation step rather than an initial access vector. At time of analysis there is no public exploit identified, CISA's SSVC assessment records Exploitation: none, and the issue is not listed in KEV; a vendor patch is available, so the practical priority is routine patch-cycle remediation rather than emergency response.
Code execution in Windows Cryptographic Services is possible when an authenticated attacker with valid low-privilege credentials and network reachability to the affected host wins a memory-lifecycle race in a freed object (use-after-free). Successful exploitation yields high confidentiality and integrity impact, but the high attack complexity (AC:H) means it depends on non-deterministic heap timing rather than a deterministic trigger, and the CVSS vector requires PR:L, so unauthenticated remote exploitation is not described. No public exploit has been identified at time of analysis, CISA SSVC records Exploitation=none and Automatable=no, and vendor patches are already available for every listed Windows client and server build.
Remote code execution in the Windows iSCSI initiator stack (CVE-2026-70013) allows a network-adjacent attacker to execute arbitrary code with high confidentiality, integrity and availability impact. Affected are the Windows iSCSI components shipped across Windows 10, Windows 11 (23H2 through 26H2) and Windows Server 2012 through Server 2025, including Server Core installations, with vendor fixes now published. Exploitation requires an active iSCSI session - typically a target the attacker controls or can inject responses into - and, because the flaw is a use-after-free race (CWE-416, AC:H), success depends on winning a memory-reuse timing window rather than issuing a single deterministic request; no public exploit code has been identified at time of analysis and CISA's SSVC assessment records Exploitation: none, so this is a serious-but-not-emergency priority rather than an active incident.
Use-after-free in the Windows Remote Desktop Client lets an unauthenticated attacker execute arbitrary code on a connecting client by luring a user into initiating an RDP session to an attacker-controlled or compromised server. The vector is network-reachable with no privileges required (PR:N), but practical exploitation depends on the victim starting the outbound connection (UI:R) and on the attacker winning a specific memory-state or timing condition (AC:H), which is consistent with CISA's SSVC rating of non-automatable and no observed exploitation. No public exploit code has been identified at time of analysis and Microsoft has published fixed builds covering all affected Windows 10, Windows 11 and Windows Server platforms; because the trigger is client-initiated rather than a passive listening service, the realistic delivery paths are malicious .rdp files, crafted links, or a hijacked RDP endpoint.
Local privilege escalation in Microsoft Windows NTFS (CVE-2026-70010) allows an authenticated, low-privileged user to corrupt kernel heap memory via crafted NTFS filesystem operations and elevate to SYSTEM. The flaw is a heap-based buffer overflow (CWE-122) in the in-kernel NTFS driver, rated CVSS 7.8 (HIGH) with the vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning the attacker must already hold a local foothold on the host but needs no user interaction and faces low attack complexity. Exploitation is not remotely reachable over the network, no public exploit code has been identified at time of analysis, and CISA's SSVC assessment records exploitation as 'none'; patch availability is confirmed through the Microsoft MSRC update guide.
A use-after-free (CWE-416) in the Microsoft Windows Remote Desktop Client allows an unauthenticated attacker to execute code on a victim's machine when that user initiates an outbound connection to an attacker-controlled RDP server. The flaw is client-side rather than a remotely reachable service bug: the attacker must control the server endpoint and also win a race condition inherent to the use-after-free (AC:H), while the victim must open a crafted .rdp file or otherwise accept the connection (UI:R), which is why the CVSS 3.1 base score sits at 7.5 even though a successful exploit yields full confidentiality, integrity and availability impact. Vendor-released patches are available, no public exploit code has been identified at time of analysis, and CISA's SSVC assessment records exploitation as none and automatable as no, so this is a moderate-priority issue rather than an urgent one.