Vulnerabilities

CVE-2026-81963 is a link-following flaw (CWE-59, improper link resolution before file access) in the Microsoft Windows Update Stack, in which the component fails to correctly resolve file links before opening them. A local attacker with low privileges can plant or manipulate a link (symlink/junction) that the privileged update stack follows during operation, redirecting its file access to an attacker-controlled target. The result is local privilege escalation — CVSS 3.1 rates this 7.8 (high) with high confidentiality, integrity, and availability impact — allowing an authorized local user or malware already on the machine to gain elevated rights. Affected products are Windows 11 23H2, 24H2, 25H2, and 26H1 and Windows Server 2025; any unpatched system on those versions is exposed to any local account holder. The flaw was fixed in Microsoft's record September 2026 Patch Tuesday (974 CVEs), was added to CISA's KEV on 2026-09-08 as one of two Windows zero-days reported as exploited in the wild, and has no known public PoC or confirmed ransomware use.

Do: Immediately deploy the September 2026 Patch Tuesday cumulative updates to every Windows 11 23H2/24H2/25H2/26H1 and Windows Server 2025 host; as a KEV entry under BOD 26-04, prioritize internet-exposed and high-value assets, apply vendor mitigations (or discontinue use) where patching is delayed, and follow CISA's forensics triage requirements if compromise is suspected. Verify deployment via patch telemetry and review which local accounts can trigger update-stack activity on shared or multi-user systems.

CVE-2026-85877 is a heap-based buffer overflow (CWE-122) in the Windows Print Spooler components, fixed by Microsoft in its September 2026 Patch Tuesday release. A remote, unauthenticated attacker can trigger the flaw by sending crafted input to the Print Spooler service over the network, though the CVSS vector (UI:R) indicates some form of user interaction is required for successful exploitation. If exploited, the attacker gains arbitrary code execution on the target system, with the CVSS base metrics indicating high impact to confidentiality, integrity, and availability. Any Windows system with the Print Spooler service enabled is affected; the available data does not enumerate specific vulnerable Windows versions or builds. There is currently no known public proof-of-concept, the flaw is not in CISA's KEV, and EPSS assigns only a 0.4% probability of exploitation within the next 30 days (37th percentile).

Do: Apply the September 2026 Microsoft Patch Tuesday security updates as soon as possible, prioritizing Windows servers and other systems where the Print Spooler is reachable from untrusted networks. As interim mitigation, disable the Print Spooler service on hosts that do not need printing and restrict inbound RPC/SMB access to spooler-enabled machines. Audit your estate for systems running the Print Spooler service and confirm patched status after deployment.

CVE-2026-81959 is a heap-based buffer overflow (CWE-122) in Microsoft Office Excel, with an associated integer overflow/wraparound (CWE-190) that Microsoft notes as part of the flaw. Because the attack vector is local and requires user interaction, exploitation requires a user to open a specially crafted spreadsheet file in an affected Excel or Office installation, for example one delivered via email or downloaded from an untrusted source. Successful exploitation allows an unauthorized attacker to execute arbitrary code in the context of the current user, with high impact on confidentiality, integrity, and availability on the victim machine. Anyone running Excel in Microsoft 365 Apps or perpetual Office 2016, 2019, 2021, or 2024 is affected. The flaw was addressed in Microsoft's September 2026 Patch Tuesday (a release covering 974 vulnerabilities); it is not in CISA KEV, no public proof-of-concept is known, and EPSS puts 30-day exploitation probability at just 0.4%, so no confirmed in-the-wild exploitation is known.

Do: Apply the September 2026 Patch Tuesday security updates for Microsoft Office/Excel across all affected channels (Microsoft 365 Apps and Office 2016/2019/2021/2024), then verify installed builds are at or above the September 2026 update level. Until patched, exercise caution with unsolicited spreadsheets, especially email attachments, since exploitation requires a user to open a malicious file.

CVE-2026-83992 is a heap-based buffer overflow (CWE-122) in the Windows Imaging Component (WIC), the built-in Windows service that decodes image files. An unauthenticated remote attacker can trigger the overflow by convincing a user to open or preview a specially crafted image; the CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R) confirms no privileges are required but user interaction is needed. Successful exploitation yields remote code execution in the context of the affected process, with high impact on confidentiality, integrity, and availability. Effectively all Windows systems that parse images with WIC are plausibly affected, though the available data does not enumerate specific Windows version ranges. There is currently no public proof-of-concept, the flaw is not in CISA KEV, and EPSS estimates only a 0.6% probability of exploitation within 30 days (47th percentile), indicating no known in-the-wild exploitation; the flaw was addressed in Microsoft's September 2026 Patch Tuesday, which fixed 973 vulnerabilities including two unrelated exploited zero-days.

Do: Apply Microsoft's September 2026 Patch Tuesday Windows security updates across all endpoints and servers, prioritizing user-facing systems. Because exploitation requires user interaction, exercise caution with image files from untrusted sources (email attachments, downloads, preview panes) until patching is complete. Verify patch status by confirming the latest Windows cumulative update is installed on each system.

CVE-2026-83997 is a use-after-free (CWE-416) vulnerability in Microsoft's Windows Message Queuing (MSMQ) service that permits an unauthenticated, remote attacker to execute arbitrary code over the network. It is triggered when the MSMQ service processes specially crafted network traffic that causes memory to be used after it has been freed, with the high attack-complexity rating (AC:H) indicating the attacker likely needs to win a timing or state race to land the free-then-use condition. Successful exploitation yields code execution in the context of the MSMQ service, with high confidentiality, integrity, and availability impact, meaning an attacker could take over the affected host. Only Windows systems that have the optional Message Queuing (MSMQ) feature installed and running are exposed, since MSMQ is not enabled by default on most Windows installations and is typically found on legacy application and queuing servers. There is no evidence of exploitation so far: the flaw is not in CISA's KEV, no public proof-of-concept is known, EPSS is 0.5% (42nd percentile), and the two actively exploited zero-days mentioned in September 2026 Patch Tuesday headlines are separate issues fixed in the same release.

Do: Apply Microsoft's September 2026 Patch Tuesday security updates for Windows, which include the fix for CVE-2026-83997, prioritizing servers where the Message Queuing (msmq/mqsvc) service is installed. Where MSMQ is not required, disable and remove the Message Queuing feature; where it is needed, restrict inbound access to MSMQ network ports from untrusted networks and verify the service is not exposed to the internet.

CVE-2026-83942 is a missing authorization flaw (CWE-862) in the Microsoft Windows Kernel: a kernel operation fails to verify that the caller holds the required permissions. It is triggered by an authorized local attacker — someone who can already execute low-privileged code on the machine — who exploits the missing check with no user interaction or network access required. Successful exploitation lets the attacker elevate privileges locally, yielding high impact on confidentiality, integrity and availability, consistent with elevation to a kernel/SYSTEM-level context and full control of the host. Any Windows system running an affected kernel version is exposed, although the affected Windows versions are not enumerated in the available data. There is currently no known in-the-wild exploitation, no public proof of concept, and EPSS estimates only a 0.2% probability of exploitation within 30 days.

Do: Monitor the Microsoft Security Response Center advisory for CVE-2026-83942 and deploy the fix via Windows Update as soon as Microsoft publishes it, since affected builds are not yet enumerated in the available data. Until patched, restrict interactive logon and code-execution rights on shared or multi-user systems to trusted users, and review endpoint telemetry for unexpected privilege-elevation or token-manipulation activity. Because this is a local privilege escalation that requires an attacker to already run code on the machine, prioritize patching endpoints where untrusted users or third-party software regularly execute.

CVE-2026-83498 is an untrusted pointer dereference (CWE-822) in the Virtualization-Based Security (VBS) Enclave component of Microsoft Windows. An authorized local attacker, meaning someone who already holds low-privileged code execution on the machine, can cause the enclave to dereference attacker-controlled pointers with no user interaction required. Successful exploitation breaks the VBS enclave trust boundary and elevates the attacker's privileges locally, with high impact on confidentiality, integrity, and availability (CVSS 3.1: 7.8). All Windows editions that ship the VBS Enclave feature are in scope, but the source data does not enumerate specific vulnerable builds, so defenders should consult Microsoft's advisory for the exact affected-product matrix. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known, EPSS assigns only a 0.3% probability of exploitation within 30 days, and fixes shipped in Microsoft's September 2026 Patch Tuesday release, which addressed 974 vulnerabilities including 2 zero-days (this CVE is not confirmed to be one of the actively exploited ones).

Do: Apply Microsoft's September 2026 Patch Tuesday cumulative updates to affected Windows systems, prioritizing multi-user hosts, jump servers, and endpoints where untrusted or low-privileged users can execute code. Verify VBS status via System Information (msinfo32) and confirm the September 2026 update is installed using the fixed-build details in Microsoft's advisory. No workaround is documented, and with no public PoC or in-the-wild exploitation known, routine patch cadence is reasonable for isolated single-user systems.

CVE-2026-83948 is a command injection flaw (CWE-77) in Microsoft Azure CLI in which special shell elements are not properly neutralized before the CLI executes commands. To trigger it, an attacker who already holds some authorized (low-privilege) access must get crafted input with special characters processed by Azure CLI in a user's session, over the network, with user interaction required and high attack complexity, per the CVSS vector. A successful attack yields remote code execution in the context of the user running the CLI, and because the CVSS scope is 'changed', code may execute beyond the vulnerable component, with high impact to confidentiality, integrity and availability. Any organization running Azure CLI on admin workstations, servers, or CI/CD pipelines is potentially affected, though specific affected and fixed versions are not stated in the available data; Microsoft shipped the fix in its September 2026 Patch Tuesday release. There is no evidence of exploitation so far: the flaw is not in CISA KEV, no public proof-of-concept is known, and EPSS assigns only a 0.4% probability of exploitation in the next 30 days.

Do: Update Azure CLI to the patched version delivered in Microsoft's September 2026 security updates (check Microsoft's advisory for the exact fixed version number). Until patched, limit Azure CLI use to trusted sessions and avoid running it with crafted or untrusted input in interactive sessions, and inventory admin workstations, jump hosts, and CI/CD runners where the tool is installed. Because exploitation requires existing authorized access, prioritize remediation on environments where lower-privileged Azure identities or external users can reach CLI sessions.

CVE-2026-83939 is an untrusted pointer dereference (CWE-822) in the Windows Secure Kernel Mode, the high-privilege virtualization-based security component of Windows. A local attacker who is already authorized and holds high privileges on the system can trigger the flaw by causing the Secure Kernel to dereference an attacker-influenced pointer, gaining local elevation of privileges. Because the CVSS scope is 'changed' (S:C), the flaw lets an attacker cross a security boundary beyond the process they started in, with high impact on confidentiality, integrity and availability. Any Windows installation whose Secure Kernel component is affected is at risk, per Microsoft's September 2026 Patch Tuesday advisory; exact version ranges are listed in Microsoft's bulletin. There is no known in-the-wild exploitation, no public proof-of-concept, and a low 0.3% EPSS probability of exploitation in the next 30 days, but a fix shipped as part of the 974-vulnerability September 2026 release.

Do: Install the September 2026 Windows security (cumulative) updates from Microsoft's Patch Tuesday release for every affected Windows version in your environment; do not skip workloads where virtualization-based security features (e.g., HVCI/Credential Guard) are enabled, as they rely on the affected Secure Kernel. Because the flaw requires an attacker to already hold high local privileges, treat it as a chaining/enabler risk for adversary-in-the-middle post-exploitation and prioritize patching hosts with many privileged users or admins. No workaround or mitigation is listed in the source data; check Microsoft's advisory for per-version applicability and any released mitigation guidance.