CVE-2026-96951ImportantCVSS 8.8Exploited (zero-day)KEVSecurity feature bypass A command injection flaw in the Windows Shell allows an unauthorized remote attacker to bypass a security feature. The affected feature is Mark of the Web, which marks files from outside the local network. Microsoft reports active exploitation, and CISA has added the flaw to its Known Exploited Vulnerabilities catalog. No authentication is needed, but a user must interact, for example by opening a crafted file received by email or instant message.
Windows, Windows ESU (Extended Security Updates), Microsoft Office, Browser (Edge) · KB5126836 KB5126868 KB5126651 KB5126657 · MSRC
VM Inspector for Azure Virtual Machines contains an improper link resolution flaw (CWE-59, link following) before file access. A network-based attacker without privileges or user interaction could exploit it to elevate privileges, and the CVSS base score is 10.0 (Critical). Microsoft states that the issue has already been fully mitigated on its side and requires no customer action; the NVD entry was still awaiting analysis at the time of research.
Azure · MSRC
Microsoft Azure Kubernetes Configuration Service contains a missing authentication check for a critical function (CWE-306). According to the CVE record, an unauthenticated attacker with network access can elevate privileges, with a CVSS 3.1 base score of 10.0 (Critical). Microsoft states that the issue has been fully mitigated on its service side and that customers have no action to take.
Azure · MSRC
Microsoft Partner Center, Microsoft's cloud-hosted management portal for partners and resellers, contains an improper certificate validation flaw (CWE-295). According to Microsoft, a network-reachable attacker without privileges and without user interaction can elevate privileges, with high impact on confidentiality and integrity (CVSS 10.0). Customers cannot patch the service themselves, because Microsoft applies the fix on its side. The main risk for SMEs is indirect, through their managed service provider or IT partner whose Partner Center access could be affected.
Azure · MSRC
Microsoft Entra application proxy (formerly Azure AD Application Proxy) publishes on-premises web applications to remote users. Improper authentication (CWE-287) allows an unauthenticated attacker over the network to elevate privileges. Microsoft rates the flaw critical (CVSS 3.1 base score 10.0) and states that customers need to take no action. No exploitation or public proof of concept was found in the sources retrieved.
Azure · MSRC
Microsoft Bookings, a cloud service for online scheduling and customer bookings in Microsoft 365, contains an authorization bypass caused by a user-controlled key (CWE-639). An unauthenticated attacker on the network can exploit it to elevate privileges, with a changed scope and high integrity impact according to the CVSS vector. Microsoft applies the fix on its own service, so customers have no patch to install.
Apps · MSRC
Windows Message Queuing (MSMQ) Queue Manager in several supported Windows client and server versions contains a use-after-free flaw (CWE-416). An unauthenticated attacker with network access to the MSMQ service can execute code remotely, and the CVSS base score is 9.8 (critical). MSMQ is not installed by default, so exposure depends on whether it is installed and reachable over the network (by default TCP/1801).
Windows, Windows ESU (Extended Security Updates) · KB5126835 KB5126836 KB5126868 KB5126651 · MSRC
A use-after-free flaw in the Microsoft QUIC transport of Windows 11 and Windows Server allows an unauthenticated remote attacker to execute code. The attacker only needs to send crafted network traffic to an affected service that uses QUIC. The CVSS base score is 9.8 (critical), and the risk depends on whether QUIC services (UDP 443) are enabled and reachable from untrusted networks.
Windows · KB5126655 KB5126653 KB5127648 KB5126646 · MSRC
A heap-based buffer overflow in Microsoft QUIC, the transport implementation used by Windows, .NET and Visual Studio, allows an unauthenticated attacker to execute code over the network. No user interaction or login is required, and the impact is rated total (confidentiality, integrity and availability) with a CVSS score of 9.8. Exposure depends mainly on whether Windows servers or .NET hosts that run QUIC or HTTP/3 services can be reached from untrusted networks.
Windows, Developer tools (.NET, Visual Studio …) · KB5126655 KB5126653 KB5127648 KB5126646 · MSRC
A heap-based buffer overflow in the Microsoft PostScript Printer Driver allows an unauthenticated attacker to execute code over the network. The flaw is triggered when the affected driver processes a specially crafted print job or packet sent to an affected print service. CVSS 3.1 rates it 9.8 (critical) with low attack complexity and no user interaction required, and CISA SSVC rates the technical impact as total.
Windows, Windows ESU (Extended Security Updates) · KB5127648 KB5126646 KB5126835 KB5126836 · MSRC
A heap-based buffer overflow in the Microsoft PostScript Printer Driver of Windows allows an unauthenticated attacker to execute code over the network. The CVSS score is 9.8 (critical). Exploitation requires no user interaction, for example by sending a specially crafted print job or packet to an affected print service.
Windows, Windows ESU (Extended Security Updates) · KB5126835 KB5126836 KB5126868 KB5126651 · MSRC
A heap-based buffer overflow in Microsoft Office Outlook allows an unauthenticated remote attacker to execute code on the affected system. According to Microsoft's CVE record, the attack requires no privileges and no user interaction, and Microsoft lists the Reading Pane as the trigger vector, so a crafted email may be sufficient. The CVSS base score is 9.8 (Critical). Microsoft has released security updates; no exploitation has been reported so far.
Microsoft Office · MSRC
A heap-based buffer overflow in Microsoft Office Outlook allows an unauthenticated attacker to execute code remotely over the network, with a CVSS 3.1 base score of 9.8 (critical). Microsoft's exploitability data rates it as unproven, and it is not publicly disclosed or known to be exploited. Research notes indicate that a crafted email may be triggered in the Reading Pane without user interaction, but Microsoft has not confirmed this preview vector, so the attack conditions remain partly unverified.
Microsoft Office · MSRC
An untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code over a network. According to Microsoft, the Reading Pane (Preview Pane) is an attack vector, so a user may not need to open a malicious document. CVSS 9.8 (Critical); Microsoft and CISA SSVC assess automatable exploitation as possible, but no exploitation has been reported.
Microsoft Office · MSRC
Microsoft Azure App Service is affected by a missing authentication flaw (CWE-306) in a critical function. An unauthenticated attacker on the network could execute code, which would have a total impact on confidentiality, integrity and availability. Microsoft states that it has fully mitigated the issue on its platform, so customers have no action to take.
Azure · MSRC
Microsoft Dataverse, the data platform behind Microsoft business applications, contains a deserialization flaw (CWE-502) that allows deserialization of untrusted data. According to the CVSS vector, an unauthenticated attacker with network access could execute code without user interaction, with a CVSS base score of 9.8. Microsoft states that the vulnerability has already been fully mitigated on its side and that no customer action is required.
Microsoft Dynamics · MSRC
A stack-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. The vulnerability is rated critical (CVSS 9.8). Per the research notes, a specially crafted email may trigger code execution through the Preview Pane without the recipient opening or clicking anything; no authentication is required.
Microsoft Office · MSRC
A use-after-free memory flaw (CWE-416) in Microsoft Office PowerPoint allows an unauthenticated attacker to execute code remotely over a network. Per the CVE record, the attack needs no login and no user privileges, and the CVSS base score is 9.8 (critical). Sources disagree on the attack path: Microsoft describes crafted presentations processed by an Office Online service, while CrowdStrike lists the Preview Pane as a vector, so a crafted file delivered by mail, download or a web-based Office service should be treated as a plausible risk.
Microsoft Office · MSRC
Microsoft has fixed a use-after-free vulnerability (CWE-416) in the Windows DHCP Server role. An unauthenticated attacker with network access can execute code on the server, and the CVSS score is 9.8 (critical). Microsoft rates exploitation as less likely and lists no public disclosure, but DHCP servers reachable from internal segments should be patched as a priority.
Windows, Windows ESU (Extended Security Updates) · KB5126836 KB5126868 KB5126651 KB5126646 · MSRC
A heap-based buffer overflow in Microsoft Office Outlook allows an unauthenticated attacker to execute code over the network, with a CVSS 3.1 base score of 9.8 (critical). Microsoft's advisory and the research notes indicate that a crafted email, processed through the preview pane, may be enough to trigger it without a click. The NVD record was still awaiting analysis in the sources reviewed, so the official scoring should be verified.
Microsoft Office · MSRC
A double free weakness (CWE-415) in Microsoft Office Outlook allows an unauthenticated remote attacker to execute code. Microsoft rates it Critical (CVSS 9.8) and describes it as network-reachable with no privileges and no user interaction. According to the advisory text cited in the research notes, simply viewing a crafted message in the Reading Pane could trigger it, so email is the main attack path.
Microsoft Office · MSRC
A heap-based buffer overflow in the Windows Text Shaping component allows an unauthorized attacker to execute code over a network. The vulnerability is rated CVSS 9.8 (critical), and according to the CVSS vector no authentication or user interaction is required. The attack surface is not identified in the sources, so exposure depends on which service processes untrusted input that reaches text rendering.
Windows, Windows ESU (Extended Security Updates) · KB5126835 KB5126836 KB5126868 KB5126651 · MSRC
Azure · MSRC
Azure Pipelines, Microsoft's CI/CD platform, contains a command injection flaw (CWE-77) that allows an unauthenticated attacker to execute code over the network. According to the CVSS vector, no privileges or user interaction are needed and the impact on confidentiality and integrity is high. Microsoft documents this CVE as a cloud service issue for which no customer action is required; the scope for self-hosted agents and on-premises Azure DevOps Server is unknown.
Developer tools (.NET, Visual Studio …) · MSRC
Microsoft Office · MSRC
Microsoft Office · KB5002928 · MSRC
Microsoft Office · MSRC
Windows, Windows ESU (Extended Security Updates) · KB5126835 KB5126836 KB5126868 KB5126651 · MSRC
Windows, Windows ESU (Extended Security Updates) · KB5126651 KB5126655 KB5126657 KB5126646 · MSRC
Windows, Windows ESU (Extended Security Updates) · KB5126835 KB5126836 KB5126868 KB5126651 · MSRC
A heap-based buffer overflow in Microsoft Office Visio, part of Microsoft 365 Apps and Office LTSC 2021/2024, allows an unauthorized attacker to execute code over a network. No privileges are required, but a user must interact, for example by opening a malicious Visio file received by email, download or shared drive. The CVSS base score is 8.8 (High).
Microsoft Office · MSRC
Microsoft Office · MSRC
Microsoft Office · MSRC
Microsoft Office · KB5002928 · MSRC
Windows, Windows ESU (Extended Security Updates) · KB5126657 KB5126655 KB5126653 KB5127648 · MSRC
Windows · MSRC
A heap-based buffer overflow in Microsoft Word, part of Microsoft 365 Apps and Office LTSC, allows remote code execution. An unauthenticated attacker can trigger it over the network, but a user must open a malicious document or follow a malicious link. Successful exploitation would give the attacker high impact on confidentiality, integrity and availability of the affected system.
Microsoft Office · MSRC
A stack-based buffer overflow in Microsoft Office Word (CWE-121) allows an unauthorized attacker to execute code over a network. The attack requires the victim to interact, most likely by opening a crafted document such as an email attachment or a download. The CNA rates the flaw CVSS 8.8 (High); a VulDB entry rates it 5.5 (Medium), and the NVD status is inconsistent across sources.
Microsoft Office · MSRC
Windows, Windows ESU (Extended Security Updates) · KB5126835 KB5126836 KB5126868 KB5126651 · MSRC
Windows · KB5126651 · MSRC
Microsoft Office · MSRC
Windows, Windows ESU (Extended Security Updates) · KB5126835 KB5126836 KB5126868 KB5126651 · MSRC
Windows, Windows ESU (Extended Security Updates) · KB5126651 KB5126655 KB5126657 KB5126646 · MSRC
Windows, Windows ESU (Extended Security Updates) · KB5126657 KB5126653 KB5127648 KB5126646 · MSRC
Microsoft Office · MSRC
Windows, Browser (Edge) · MSRC
Windows, Windows ESU (Extended Security Updates) · KB5127648 KB5126646 KB5126651 KB5126657 · MSRC
Windows, Windows ESU (Extended Security Updates) · KB5126653 KB5127648 KB5126646 KB5127646 · MSRC
Windows · MSRC
Windows, Windows ESU (Extended Security Updates) · KB5126651 KB5126657 KB5126655 KB5126653 · MSRC
