SANS Internet Storm Center

Related CVEsby mentions

• CVE-2026-858807.8<1%
  Heap-Based Buffer Overflow in Windows ALPC Enables Local Privilege Escalation
  CVE-2026-85880 is a heap-based buffer overflow in Windows Advanced Local Procedure Call (ALPC), the Windows mechanism for local inter-process communication. An authorized local attacker can trigger the overflow by submitting crafted input over ALPC, corrupting heap memory in the component that handles the request. Successful exploitation allows the attacker to execute code with elevated privileges, typically gaining SYSTEM-level control of the local host, which is especially valuable as a post-exploitation or sandbox-escape step. Affected products include Windows 10 (1607, 1809, 21H2, 22H2) and Windows Server 2012, 2016, 2019, and 2022, meaning most on-premises Windows estates are in scope. The flaw was fixed in Microsoft's record 974-CVE September 2026 Patch Tuesday and was added to CISA's KEV on 2026-09-08, confirming exploitation in the wild; press reports describe Windows zero-days being chained with a Chrome zero-day in 'BlueMoon' kit attacks, though the data does not explicitly confirm this CVE is the Windows flaw in that chain.
  · Microsoft Windows 10 1607, 1809, 21H2, 22H2 · Microsoft Windows Server 2012, 2016, 2019, 2022 KEVmass
• CVE-2026-819637.8<1%
  Local Privilege Escalation via Link Following in Windows Update Stack
  CVE-2026-81963 is a link-following flaw (CWE-59, improper link resolution before file access) in the Microsoft Windows Update Stack, in which the component fails to correctly resolve file links before opening them. A local attacker with low privileges can plant or manipulate a link (symlink/junction) that the privileged update stack follows during operation, redirecting its file access to an attacker-controlled target. The result is local privilege escalation — CVSS 3.1 rates this 7.8 (high) with high confidentiality, integrity, and availability impact — allowing an authorized local user or malware already on the machine to gain elevated rights. Affected products are Windows 11 23H2, 24H2, 25H2, and 26H1 and Windows Server 2025; any unpatched system on those versions is exposed to any local account holder. The flaw was fixed in Microsoft's record September 2026 Patch Tuesday (974 CVEs), was added to CISA's KEV on 2026-09-08 as one of two Windows zero-days reported as exploited in the wild, and has no known public PoC or confirmed ransomware use.
  · Microsoft Windows 11 23H2, 24H2, 25H2, 26H1 · Microsoft Windows Server 2025 KEVmass
• CVE-2026-697309.81%
  Use-After-Free RCE in Windows DNS Server
  CVE-2026-69730 is a use-after-free memory corruption flaw (CWE-416) in the Windows DNS service that allows an unauthenticated, remote attacker to execute arbitrary code by sending crafted network traffic to the affected system. Because the flaw is network-exploitable with no privileges or user interaction required (CVSS 3.1 9.8), any system running the vulnerable DNS service is a direct target. Successful exploitation would give the attacker code execution in the context of the DNS service, which on Windows Server typically runs with high privileges such as SYSTEM, and could enable wormable spread between vulnerable hosts. Affected organizations are those running the Windows DNS Server role — a component deployed on virtually all Windows Server domain controllers and on dedicated Windows DNS servers, especially those exposed to untrusted networks. As of the September 2026 Patch Tuesday release, there is no known public proof-of-concept, the flaw is not listed in CISA's KEV, and it has not been confirmed exploited in the wild, though it was flagged among roughly 20 'wormable' bugs and described in press coverage as a successor to the 2020 SigRed Windows DNS RCE.
  · Microsoft Windows DNS Server role (Windows Server)mass
• CVE-2026-698299.81%
  Unauthenticated Heap Buffer Overflow RCE in Microsoft Windows Shell
  CVE-2026-69829 is a heap-based buffer overflow (CWE-122) in the Microsoft Windows Shell. According to its CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N), an unauthorized remote attacker could trigger the flaw over a network without needing privileges, user interaction, or special conditions. Successful exploitation would allow the attacker to execute code on the affected host, with high impact on confidentiality, integrity, and availability. All Windows installations that include the Windows Shell component are potentially affected, though the available data does not enumerate specific vulnerable version ranges. There is currently no known public proof-of-concept, the CVE is not in CISA's KEV, and EPSS assigns roughly a 1.1% probability of exploitation within 30 days; the related headlines note Microsoft's record patch release of 974 flaws included two other exploited Windows zero-days, but no confirmed in-the-wild exploitation of this specific CVE is documented.
  · Microsoft Windows Shell (Windows operating system component)mass

Appears with