CVE-2026-109478

ASP.NET Core Denial of Service Vulnerability

Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service over a network.

CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed

Vendors

Microsoft

Products

.net 8.0 Installed On Linux .net 8.0 Installed On Mac Os .net 8.0 Installed On Windows and 6 more

CVE-2026-109457

Azure CLI Remote Code Execution Vulnerability

Improper neutralization of special elements used in an os command ('os command injection') in Azure CLI allows an authorized attacker to execute code over a network.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Azure Machine Learning

CVE-2026-109464

Microsoft Office SharePoint Remote Code Execution Vulnerability

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS 1.9% KEV · Not listed

Vendors

Microsoft

Products

Sharepoint Server

CVE-2026-109466

Microsoft Office SharePoint Elevation of Privilege Vulnerability

Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over an adjacent network.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Sharepoint Server

CVE-2026-109472

Microsoft Office SharePoint Remote Code Execution Vulnerability

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS 1.6% KEV · Not listed

Vendors

Microsoft

Products

Sharepoint Server

CVE-2026-109481

ASP.NET Core Elevation of Privilege Vulnerability

Cross-site request forgery (csrf) in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

.net 11.0 Installed On Linux .net 11.0 Installed On Mac Os .net 11.0 Installed On Windows and 1 more

CVE-2026-109492

Microsoft MCP Gateway Elevation of Privilege Vulnerability

Authorization bypass through user-controlled key in Microsoft MCP Gateway allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Mcp Gateway

CVE-2026-109487

Microsoft PowerPoint Remote Code Execution Vulnerability

Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Microsoft Office Ltsc 2021 Microsoft Office Ltsc 2024 and 7 more

CVE-2026-105509

Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability

Use after free in Windows Resilient File System (ReFS) allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 11 26h1 Windows 11 26h1

CVE-2026-105507

Windows Installer Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists in the Windows Installer when the Windows Installer fails to properly sanitize input leading to an insecure library loading behavior. A locally authenticated attacker could run arbitrary code with elevated system privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. The security update addresses the vulnerability by correcting the input sanitization error to preclude unintended elevation.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 20 more

CVE-2026-105515

Windows Message Queuing Denial of Service Vulnerability

Buffer over-read in Windows Message Queuing allows an unauthorized attacker to deny service over a network.

CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 20 more

CVE-2026-105520

Windows DNS Elevation of Privilege Vulnerability

Improper link resolution before file access ('link following') in Windows DNS allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows Server 2016 Windows Server 2016 (server Core Installation) Windows Server 2019 and 4 more

CVE-2026-105524

Windows Management Instrumentation Elevation of Privilege Vulnerability

Weak authentication in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 20 more

CVE-2026-109473

Windows Kernel Elevation of Privilege Vulnerability

Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 20 more

CVE-2026-109504

Microsoft Office SharePoint Spoofing Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Sharepoint Server

CVE-2026-119981

Visual Studio Code Elevation of Privilege Vulnerability

Missing authentication for critical function in Visual Studio Code allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Visual Studio Code

CVE-2026-119975

Visual Studio Code Remote Code Execution Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Visual Studio Code

CVE-2026-122194

Microsoft Defender Remote Code Execution Vulnerability

Null pointer dereference in Microsoft Defender allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Malware Protection Engine

CVE-2026-119985

Visual Studio Code Remote Code Execution Vulnerability

Incorrect authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Visual Studio Code

CVE-2026-120780

Visual Studio Code Remote Code Execution Vulnerability

Improper access control in Visual Studio Code allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Visual Studio Code