CVE-2026-88240

Windows DHCP Client Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows DHCP Client allows an authorized attacker to elevate privileges over an adjacent network.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 10 more

CVE-2026-88237

Windows Subsystem for Linux Elevation of Privilege Vulnerability

Use after free in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 21h2 Windows 10 22h2 Windows 11 23h2 and 6 more

CVE-2026-88215

Windows Filtering Platform (WFP) Elevation of Privilege Vulnerability

Use after free in Windows Filtering Platform (WFP) allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 10 more

CVE-2026-88187

Windows Bluetooth A2DP driver Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Bluetooth A2DP driver allows an authorized attacker to elevate privileges over an adjacent network.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1809 Windows 10 21h2 Windows 10 22h2 and 8 more

CVE-2026-85923

Azure DevOps Server Elevation of Privilege Vulnerability

Authorization bypass through user-controlled key in Azure DevOps Server allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Azure Devops Server

CVE-2026-83953

GitHub Copilot for Jetbrains Information Disclosure Vulnerability

Improper neutralization of special elements used in a command ('command injection') in Github Copilot allows an authorized attacker to disclose information locally.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Gihub Copilot Plugin For Jetbrains Ides

CVE-2026-66813

Microsoft SQL Server Elevation of Privilege Vulnerability

Out-of-bounds read in SQL Server allows an unauthorized attacker to elevate privileges over a network.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Microsoft Sql Server 2017 For X64-based Systems \(cu31\) Microsoft Sql Server 2019 For X64-based Systems \(cu32\) Microsoft Sql Server 2022 For X64-based Systems \(cu27\) and 5 more

CVE-2026-67382

Microsoft SQL Server Information Disclosure Vulnerability

Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network.

CVSS 3.1 · 6.5 Medium EPSS 1.1% KEV · Not listed

Vendors

Microsoft

Products

Microsoft Sql Server 2017 For X64-based Systems \(cu31\) Microsoft Sql Server 2019 For X64-based Systems \(cu32\) Microsoft Sql Server 2022 For X64-based Systems \(cu27\) and 5 more

CVE-2026-96992

Windows PCI Bus Driver Elevation of Privilege Vulnerability

Use after free in Windows PCI Bus Driver allows an unauthorized attacker to elevate privileges with a physical attack.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 21h2 Windows 10 22h2 Windows 11 23h2 and 6 more

CVE-2026-97015

Windows BitLocker Security Feature Bypass Vulnerability

Heap-based buffer overflow in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 12 more

CVE-2026-97013

Windows Shell Elevation of Privilege Vulnerability

Access of resource using incompatible type ('type confusion') in Windows Shell allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 10 more

CVE-2026-96965

Windows Hyper-V Denial of Service Vulnerability

Null pointer dereference in Windows Hyper-V allows an authorized attacker to deny service locally.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 10 more

CVE-2026-96978

Windows Credential User Interface Elevation of Privilege Vulnerability

Use after free in Windows Credential User Interface allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 10 more

CVE-2026-67387

Microsoft SQL Server Elevation of Privilege Vulnerability

Untrusted pointer dereference in SQL Server allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 8.8 High EPSS 1.0% KEV · Not listed

Vendors

Microsoft

Products

Microsoft Sql Server 2017 For X64-based Systems \(cu31\) Microsoft Sql Server 2019 For X64-based Systems \(cu32\) Microsoft Sql Server 2022 For X64-based Systems \(cu27\) and 5 more

CVE-2026-96184

Windows Modern Device Management (MDM) Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 10 more

CVE-2026-96179

Windows DNS Elevation of Privilege Vulnerability

Use after free in DNS Server allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows Server 2016 Windows Server 2019 Windows Server 2022 and 1 more

CVE-2026-96176

Windows DNS Denial of Service Vulnerability

Missing release of memory after effective lifetime in Windows DNS allows an unauthorized attacker to deny service over a network.

CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed

Vendors

Microsoft

Products

Windows 11 23h2 Windows 11 24h2 Windows 11 25h2 and 3 more

CVE-2026-96174

Desktop Window Manager Elevation of Privilege Vulnerability

Release of invalid pointer or reference in Desktop Window Manager allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1809 Windows 10 21h2 Windows 10 22h2 and 7 more

CVE-2026-96171

Windows Graphics Kernel Elevation of Privilege Vulnerability

Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 10 more

CVE-2026-96158

Microsoft ActiveX Installer Service Elevation of Privilege Vulnerability

Use of uninitialized resource in Microsoft ActiveX Installer Service allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 10 more