CVE-2026-49173

Windows Kernel Elevation of Privilege Vulnerability

Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 11 26h1 Windows 11 26h1

CVE-2026-55134

Microsoft Word Remote Code Execution Vulnerability

Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Microsoft 365 Office 2019 and 10 more

CVE-2026-55038

Microsoft Word Remote Code Execution Vulnerability

Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Microsoft 365 Office 2019 and 10 more

CVE-2026-55032

Microsoft Word Remote Code Execution Vulnerability

Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Microsoft 365 Office 2019 and 10 more

CVE-2026-55123

Microsoft PowerPoint Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Microsoft 365 Office 2019 and 7 more

CVE-2026-55008

Microsoft Exchange Server Spoofing Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Exchange Server Exchange Server 2016 Exchange Server 2019 and 2 more

CVE-2026-55005

Microsoft Exchange Server Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Exchange Server allows an authorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS 1.0% KEV · Not listed

Vendors

Microsoft

Products

Exchange Server Exchange Server 2016 Exchange Server 2019 and 2 more

CVE-2026-57969

Azure CycleCloud Elevation of Privilege Vulnerability

Missing authentication for critical function in Azure CycleCloud allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Azure Cyclecloud

CVE-2026-50412

Windows NTFS Elevation of Privilege Vulnerability

Stack-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 16 more

CVE-2026-54112

Windows Win32k Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1809 Windows 10 21h2 Windows 10 21h2 and 13 more

CVE-2026-50510

GitHub Copilot Remote Code Execution Vulnerability

Improper restriction of names for files and other resources in Github Copilot allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Gihub Copilot Plugin For Jetbrains Ides Github Copilot

CVE-2026-57973

Windows Subsystem for Linux (WSL2) Kernel Tampering Vulnerability

Time-of-check time-of-use (toctou) race condition in Windows Subsystem for Linux allows an authorized attacker to perform tampering locally.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows Subsystem For Linux

CVE-2026-50336

Windows Media Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Media allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 11 24h2 Windows 11 24h2 Windows 11 25h2 and 3 more

CVE-2026-50379

Windows Media Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Media allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 11 24h2 Windows 11 24h2 Windows 11 25h2 and 3 more

CVE-2026-50676

Windows Media Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Media allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 11 24h2 Windows 11 24h2 Windows 11 25h2 and 3 more

CVE-2026-55012

Microsoft Defender Remote Code Execution Vulnerability

Integer overflow or wraparound in Microsoft Defender allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Malware Protection Engine

CVE-2026-50438

Microsoft PC Manager Elevation of Privilege Vulnerability

Improper link resolution before file access ('link following') in Microsoft PC Manager allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Pc Manager

CVE-2026-56169

Windows Admin Center Elevation of Privilege Vulnerability

Improper authentication in Windows Admin Center allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows Admin Center

CVE-2026-57107

Windows Admin Center Elevation of Privilege Vulnerability

Improper authentication in Windows Admin Center allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows Admin Center

CVE-2026-55041

Microsoft Excel Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Excel Excel 2016 and 8 more