2026 comparison of 11 device control and USB security tools ranks CoSoSys Endpoint Protector first for cross-platform control and DLP.
An editorial scorecard evaluates eleven device control and removable-media security tools across granularity, content-aware DLP, cross-platform parity, encryption/shadowing, and value. CoSoSys Endpoint Protector (now part of Netwrix) leads at 4.60 for genuine Windows, macOS, and Linux parity, with Ivanti DeviceLock at 4.25 for the deepest Windows peripheral control and Safetica positioned for SMB and mid-market value. Enterprise content-aware DLP anchors include Symantec (Broadcom), Forcepoint, Digital Guardian (Fortra), and Trellix, with pricing almost always per endpoint.
Microsoft's September 2026 Patch Tuesday fixes a record 974 CVEs, including two Windows zero-days exploited in the wild for privilege escalation.
Microsoft patched 974 vulnerabilities, its largest Patch Tuesday ever, including CVE-2026-85880, a heap buffer overflow in Windows ALPC allowing AppContainer sandbox escape to System, and CVE-2026-81963, a link-following flaw in the Windows Update Stack enabling local privilege escalation. Both were exploited as zero-days before the patch. ZDI's Dustin Childs says 20 of the fixed flaws are wormable, enabling unauthenticated remote code execution. The release also covers 723 Windows flaws and 222 Office bugs, plus fixes in Exchange, SharePoint, SQL Server, Azure and Exchange Server RCE (CVE-2026-55007).
Use-After-Free Privilege Escalation in Microsoft Windows ALPC
CVE-2023-21674 is a use-after-free flaw (CWE-416) in the Windows Advanced Local Procedure Call (ALPC) facility, the kernel-level mechanism Windows uses for fast communication between processes and system services. An attacker who can already run code on a Windows machine can trigger the bug by sending crafted ALPC requests, corrupting memory in a privileged process. Successful exploitation allows a local, low-privileged attacker to elevate to SYSTEM/administrator privileges, typically to gain full control of the host or to complete an exploit chain after an initial compromise. Essentially all supported Windows client and server installations from Microsoft are affected; the source data does not list specific versions, and the fix shipped with Microsoft's January 2023 Patch Tuesday, which addressed a record 974 vulnerabilities including this and one other actively exploited Windows zero-day. CISA added the CVE to the Known Exploited Vulnerabilities catalog on 2023-01-10, confirming exploitation in the wild; no public proof-of-concept is known, ransomware use is undetermined, and EPSS estimates a 41.8% probability of exploitation in the next 30 days (99th percentile).
Heap-Based Buffer Overflow in Windows ALPC Enables Local Privilege Escalation
CVE-2026-85880 is a heap-based buffer overflow in Windows Advanced Local Procedure Call (ALPC), the Windows mechanism for local inter-process communication. An authorized local attacker can trigger the overflow by submitting crafted input over ALPC, corrupting heap memory in the component that handles the request. Successful exploitation allows the attacker to execute code with elevated privileges, typically gaining SYSTEM-level control of the local host, which is especially valuable as a post-exploitation or sandbox-escape step. Affected products include Windows 10 (1607, 1809, 21H2, 22H2) and Windows Server 2012, 2016, 2019, and 2022, meaning most on-premises Windows estates are in scope. The flaw was fixed in Microsoft's record 974-CVE September 2026 Patch Tuesday and was added to CISA's KEV on 2026-09-08, confirming exploitation in the wild; press reports describe Windows zero-days being chained with a Chrome zero-day in 'BlueMoon' kit attacks, though the data does not explicitly confirm this CVE is the Windows flaw in that chain.
· Microsoft Windows 10 1607, 1809, 21H2, 22H2 · Microsoft Windows Server 2012, 2016, 2019, 2022 KEVmass
Local Privilege Escalation via Link Following in Windows Update Stack
CVE-2026-81963 is a link-following flaw (CWE-59, improper link resolution before file access) in the Microsoft Windows Update Stack, in which the component fails to correctly resolve file links before opening them. A local attacker with low privileges can plant or manipulate a link (symlink/junction) that the privileged update stack follows during operation, redirecting its file access to an attacker-controlled target. The result is local privilege escalation — CVSS 3.1 rates this 7.8 (high) with high confidentiality, integrity, and availability impact — allowing an authorized local user or malware already on the machine to gain elevated rights. Affected products are Windows 11 23H2, 24H2, 25H2, and 26H1 and Windows Server 2025; any unpatched system on those versions is exposed to any local account holder. The flaw was fixed in Microsoft's record September 2026 Patch Tuesday (974 CVEs), was added to CISA's KEV on 2026-09-08 as one of two Windows zero-days reported as exploited in the wild, and has no known public PoC or confirmed ransomware use.
· Microsoft Windows 11 23H2, 24H2, 25H2, 26H1 · Microsoft Windows Server 2025 KEVmass
Use-After-Free RCE in Windows Remote Desktop Services
CVE-2026-69525 is a use-after-free memory corruption flaw (CWE-416) in Windows Remote Desktop Services, rated critical at CVSS 9.8. Per the CVSS vector, a remote, unauthenticated attacker can reach the vulnerable code path over the network with no privileges and no user interaction, presumably by sending crafted input to the RDP/RDS service. Successful exploitation yields remote code execution with high impact on confidentiality, integrity, and availability. Any Windows system running Remote Desktop Services is affected, and organizations exposing RDP (TCP 3389) to the internet are the primary concern, since public scans show millions of such endpoints. There is no public proof-of-concept or CISA KEV listing yet, and EPSS estimates a ~1.1% (63rd percentile) chance of exploitation within 30 days; the fix shipped as part of Microsoft's record 974-CVE Patch Tuesday, which separately included two exploited Windows zero-days and 20 wormable bugs.
Injection Flaw in Microsoft SQL Server Enables Network Privilege Escalation
Microsoft SQL Server contains an injection vulnerability (CWE-74) in which special elements in output used by a downstream component are not properly neutralized. An unauthorized attacker can trigger the flaw remotely over a network, though the CVSS vector indicates that some form of user interaction is required in the attack path. Successful exploitation allows elevation of privileges with high impact on confidentiality, integrity, and availability, and the changed-scope metric suggests the attack crosses a security boundary into another component. Any organization running affected Microsoft SQL Server versions is potentially exposed, although the data provided does not specify exact affected version ranges. No public proof of concept, CISA KEV listing, or known exploitation exists; EPSS estimates only a 0.7% probability of exploitation in the next 30 days, and the fix shipped with Microsoft's record-setting September 2026 Patch Tuesday release (974 flaws patched).
Missing Authorization Allows Authenticated RCE in Microsoft SharePoint Server
CVE-2026-69465 is a missing authorization flaw (CWE-862) in Microsoft Office SharePoint, specifically SharePoint Server. An attacker who already holds valid, low-privileged credentials can send a crafted network request to the server, and because the application fails to properly verify permissions, the request results in arbitrary code execution. Successful exploitation gives the attacker code execution on the server with high impact on confidentiality, integrity, and availability (CVSS 3.1: 8.8 High), with no user interaction required. Organizations running on-premises SharePoint Server are affected; the specific version ranges are not stated in the available data. There is currently no known in-the-wild exploitation, no public proof-of-concept, and the flaw is not listed in CISA KEV, with EPSS estimating a 0.8% chance of exploitation within 30 days.
Improper Authentication in Microsoft Authenticator Enables Local Privilege Escalation
CVE-2026-80097 is an improper authentication flaw (CWE-287) in Microsoft Authenticator that allows an unauthorized attacker to elevate privileges locally, rated 8.6 (high) with no privileges required, required user interaction, and a changed scope. Exploitation requires local access to a device running the app plus user interaction, and because the scope is changed, a successful attack crosses a security boundary beyond the Authenticator component itself. A successful exploit yields local privilege elevation with high impact to confidentiality, integrity, and availability. Anyone running affected versions of Microsoft Authenticator is affected; the app is Microsoft's standard multi-factor authentication app for Entra ID/Microsoft 365 and is widely deployed across enterprise and personal mobile devices. As of the September 2026 disclosure it is not known to be exploited - no public PoC, not in CISA KEV, EPSS 0.4% (33rd percentile) - and it was patched amid the record 974-flaw Patch Tuesday, though the two actively exploited zero-days in that release are Windows flaws, not this one.
Double Free Enables Unauthenticated RCE in Microsoft Exchange Server
CVE-2026-55007 is a double-free memory corruption flaw (CWE-415) in Microsoft Exchange Server in which the same heap allocation is freed twice, corrupting memory. A remote, unauthenticated attacker can trigger the flaw over the network, though the high attack complexity (AC:H) means reliable exploitation likely depends on favorable heap/timing conditions, making it harder to weaponize than typical pre-auth RCEs. Successful exploitation yields arbitrary code execution with high impact on confidentiality, integrity, and availability (CVSS 3.1: 8.1). Any organization running on-premises Microsoft Exchange Server is in scope, with the greatest risk on servers reachable from untrusted networks. As of now there is no public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS estimates only a 0.7% chance of exploitation within 30 days; it was disclosed amid Microsoft's record September 2026 Patch Tuesday (974 CVEs), which press coverage highlighted for notable Exchange flaws.
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.