CVE-2026-109478

ASP.NET Core Denial of Service Vulnerability

Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service over a network.

CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed

Vendors

Microsoft

Products

.net 8.0 Installed On Linux .net 8.0 Installed On Mac Os .net 8.0 Installed On Windows and 6 more

CVE-2026-109454

Microsoft Office SharePoint Spoofing Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

CVSS 3.1 · 9 Critical EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Sharepoint Server

CVE-2026-109456

Microsoft Office SharePoint Spoofing Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Sharepoint Server

CVE-2026-109457

Azure CLI Remote Code Execution Vulnerability

Improper neutralization of special elements used in an os command ('os command injection') in Azure CLI allows an authorized attacker to execute code over a network.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Azure Machine Learning

CVE-2026-109460

Microsoft Entra Private Network Connector Information Disclosure Vulnerability

Exposure of sensitive information to an unauthorized actor in Microsoft Entra Private Network Connector allows an authorized attacker to disclose information locally.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Entra Private Network Connector

CVE-2026-109464

Microsoft Office SharePoint Remote Code Execution Vulnerability

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS 1.9% KEV · Not listed

Vendors

Microsoft

Products

Sharepoint Server

CVE-2026-109466

Microsoft Office SharePoint Elevation of Privilege Vulnerability

Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over an adjacent network.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Sharepoint Server

CVE-2026-109472

Microsoft Office SharePoint Remote Code Execution Vulnerability

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS 1.6% KEV · Not listed

Vendors

Microsoft

Products

Sharepoint Server

CVE-2026-109481

ASP.NET Core Elevation of Privilege Vulnerability

Cross-site request forgery (csrf) in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

.net 11.0 Installed On Linux .net 11.0 Installed On Mac Os .net 11.0 Installed On Windows and 1 more

CVE-2026-109492

Microsoft MCP Gateway Elevation of Privilege Vulnerability

Authorization bypass through user-controlled key in Microsoft MCP Gateway allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Mcp Gateway

CVE-2026-108425

Windows DNS Information Disclosure Vulnerability

Out-of-bounds read in Windows DNS allows an unauthorized attacker to disclose information over a network.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows Server 2016 Windows Server 2016 (server Core Installation) Windows Server 2019 and 4 more

CVE-2026-109485

Microsoft 365 Agents SDK Information Disclosure Vulnerability

Server-side request forgery (ssrf) in Microsoft 365 Agents SDK allows an authorized attacker to disclose information over a network.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Microsoft Agent Framework Sdk For Dotnet

CVE-2026-109487

Microsoft PowerPoint Remote Code Execution Vulnerability

Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Microsoft Office Ltsc 2021 Microsoft Office Ltsc 2024 and 7 more

CVE-2026-105509

Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability

Use after free in Windows Resilient File System (ReFS) allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 11 26h1 Windows 11 26h1

CVE-2026-105507

Windows Installer Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists in the Windows Installer when the Windows Installer fails to properly sanitize input leading to an insecure library loading behavior. A locally authenticated attacker could run arbitrary code with elevated system privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. The security update addresses the vulnerability by correcting the input sanitization error to preclude unintended elevation.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 20 more

CVE-2026-105515

Windows Message Queuing Denial of Service Vulnerability

Buffer over-read in Windows Message Queuing allows an unauthorized attacker to deny service over a network.

CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 20 more

CVE-2026-105520

Windows DNS Elevation of Privilege Vulnerability

Improper link resolution before file access ('link following') in Windows DNS allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows Server 2016 Windows Server 2016 (server Core Installation) Windows Server 2019 and 4 more

CVE-2026-105524

Windows Management Instrumentation Elevation of Privilege Vulnerability

Weak authentication in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 20 more

CVE-2026-109473

Windows Kernel Elevation of Privilege Vulnerability

Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 20 more

CVE-2026-108469

Microsoft Authentication Library for JavaScript Spoofing Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Authentication Library for JavaScript allows an unauthorized attacker to perform spoofing over a network.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Authentication Library For Javascript