CVE-2026-55136

Microsoft Excel Remote Code Execution Vulnerability

Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Excel Excel 2016 and 12 more

CVE-2026-55035

Microsoft Office Information Disclosure Vulnerability

Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Microsoft 365 Microsoft 365 Apps For Enterprise and 17 more

CVE-2026-55057

Microsoft Office Information Disclosure Vulnerability

Integer overflow or wraparound in Microsoft Office allows an unauthorized attacker to disclose information locally.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Microsoft 365 Microsoft 365 Apps For Enterprise and 7 more

CVE-2026-55051

Microsoft SharePoint Server Information Disclosure Vulnerability

Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Sharepoint Server Sharepoint Server 2016 Sharepoint Server 2019 and 1 more

CVE-2026-55142

Microsoft Word Information Disclosure Vulnerability

Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to disclose information locally.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Microsoft 365 Microsoft Office Ltsc 2021 and 11 more

CVE-2026-55128

Microsoft Word Remote Code Execution Vulnerability

Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Microsoft 365 Microsoft Office 365 For Mac and 13 more

CVE-2026-55130

Microsoft Word Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Office 2019 Office 2021 and 7 more

CVE-2026-55120

Microsoft PowerPoint Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Microsoft 365 Microsoft 365 Apps For Enterprise and 11 more

CVE-2026-55135

Microsoft SharePoint Server Spoofing Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Sharepoint Server Sharepoint Server 2016 Sharepoint Server 2019 and 1 more

CVE-2026-56157

Microsoft SharePoint Server Spoofing Vulnerability

Improper access control in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Sharepoint Server Sharepoint Server 2016 Sharepoint Server 2019 and 1 more

CVE-2026-56159

DHCP Server Service Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows Server 2012 and 11 more

CVE-2026-50359

Microsoft XML Core Services Elevation of Privilege Vulnerability

Use after free in Microsoft XML Core Services allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 21 more

CVE-2026-56168

Windows SMB Server Denial of Service Vulnerability

Null pointer dereference in Windows SMB Server allows an authorized attacker to deny service over a network.

CVSS 3.1 · 6.5 Medium EPSS 1.1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 21h2 Windows 10 21h2 Windows 10 22h2 and 10 more

CVE-2026-56173

Windows WebView Elevation of Privilege Vulnerability

Use after free in Windows WebView allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1809 Windows 10 21h2 Windows 10 21h2 and 15 more

CVE-2026-56175

Windows NTFS Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 21 more

CVE-2026-56182

Windows NTFS Elevation of Privilege Vulnerability

Integer overflow or wraparound in Windows NTFS allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 21 more

CVE-2026-56183

Windows MIDI Service Module Elevation of Privileges Vulnerability

Use after free in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 11 24h2 Windows 11 24h2 Windows 11 25h2 and 3 more

CVE-2026-56190

Remote Desktop Protocol Remote Code Execution Vulnerability

Use of uninitialized resource in Windows RDP allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 21 more

CVE-2026-56187

Windows MIDI Service Module Elevation of Privileges Vulnerability

Use after free in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 11 24h2 Windows 11 24h2 Windows 11 25h2 and 3 more

CVE-2026-56186

Windows Secure Channel Information Disclosure Vulnerability

Out-of-bounds read in Windows Schannel allows an authorized attacker to disclose information over a network.

CVSS 3.1 · 8.1 High EPSS 1.1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 21 more