CVE-2026-69554

Microsoft Windows Search Component Tampering Vulnerability

Missing authentication for critical function in Microsoft Windows Search Component allows an authorized attacker to perform tampering locally.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 23 more

CVE-2026-69496

Windows Compressed Folder Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows Compressed Folder allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 23 more

CVE-2026-69491

Microsoft DirectMusic Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows Microsoft DirectMusic allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 23 more

CVE-2026-69568

Storage Spaces Controller Information Disclosure Vulnerability

Out-of-bounds read in Windows Storage Spaces Controller allows an authorized attacker to disclose information locally.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 23 more

CVE-2026-69585

Microsoft Windows Search Component Elevation of Privilege Vulnerability

Incorrect type conversion or cast in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 23 more

CVE-2026-56176

Windows Win32k Elevation of Privilege Vulnerability

Out-of-bounds read in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Office Office 365 Office Macos 2021 and 25 more

CVE-2026-40400

Windows PowerShell Remote Code Execution Vulnerability

Relative path traversal in Windows PowerShell allows an authorized attacker to execute code over a network.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Powershell Windows 10 1607 Windows 10 1809 and 16 more

CVE-2026-72987

Windows DNS Remote Code Execution Vulnerability

Use after free in Windows DNS allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows Server 2012 and 11 more

CVE-2026-72979

Windows DHCP Server Remote Code Execution Vulnerability

Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows Server 2012 and 11 more

CVE-2026-72967

Windows Network Connection Broker Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Network Connection Broker allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 23 more

CVE-2026-73009

Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability

Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 23 more

CVE-2026-73012

Windows Management Services Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Management Services allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 23 more

CVE-2026-73023

Windows Imaging Component Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 23 more

CVE-2026-73024

Windows Services for NFS ONCRPC XDR Driver Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Services for NFS ONCRPC XDR Driver allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 23 more

CVE-2026-73025

Windows iSCSI Security Feature Bypass Vulnerability

Weak authentication in Windows iSCSI allows an unauthorized attacker to bypass a security feature over a network.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows Server 2012 and 11 more

CVE-2026-72966

Windows Remote Access Connection Manager Tampering Vulnerability

Missing authorization in Windows Remote Access Connection Manager allows an authorized attacker to perform tampering locally.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 22 more

CVE-2026-69607

Windows Deployment Services Remote Code Execution Vulnerability

Use after free in Windows Deployment Services allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows Server 2012 and 11 more

CVE-2026-70586

Windows Paint Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows Paint allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 23 more

CVE-2026-70585

Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability

Use after free in Windows Services for NFS ONCRPC XDR Driver allows an authorized attacker to execute code locally.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows Server 2012 Windows Server 2012 (server Core Installation) Windows Server 2012 R2 and 9 more

CVE-2026-50349

Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 23 more