Authentication Bypass in Microsoft Entra ID Enables Privilege Elevation
CVE-2026-62916 is an authentication bypass (CWE-288) in Microsoft Entra ID, Microsoft's cloud identity and access management service, in which an alternate path or channel allows authentication checks to be circumvented. Per the CVSS vector, it is exploitable remotely over a network with no privileges and no user interaction required, by authenticating via an alternate path instead of the standard sign-in flow. A successful unauthenticated attacker gains the ability to elevate privileges, with high impact on confidentiality, integrity, and availability reflected in the 9.8 critical score. The affected population includes organizations relying on Entra ID, which is the default identity platform for Microsoft 365, Azure, and hybrid deployments; the available data does not specify affected versions or the specific sub-component involved. There is no public proof-of-concept, no confirmed in-the-wild exploitation, and the CVE is not in CISA's KEV; EPSS assigns a 0.6% probability of exploitation within 30 days.
· Microsoft Entra IDmass
Heap-Based Buffer Overflow in Windows Imaging Component Allows Network RCE
CVE-2026-69860 is a heap-based buffer overflow (CWE-122) in the Windows Imaging Component, the built-in Windows subsystem responsible for decoding image formats. An unauthenticated remote attacker can trigger the flaw by getting a user to open or preview a specially crafted image file (the CVSS vector is network-based but requires user interaction). Successful exploitation allows arbitrary code execution in the context of the affected user, with high impact on confidentiality, integrity, and availability. Any Windows installation carrying the affected Imaging Component is exposed, and the fix is distributed through Microsoft's September 2026 security updates. There is currently no known in-the-wild exploitation, no public proof-of-concept, the flaw is not in CISA KEV, and EPSS puts 30-day exploitation probability at roughly 0.8%.
· Microsoft Windows Imaging Component (component of Windows client and server editions)mass
Heap Buffer Overflow RCE in Windows Routing and Remote Access Service (RRAS)
Microsoft's Routing and Remote Access Service (RRAS) contains a heap-based buffer overflow (CWE-122) that permits remote code execution on the host running the service. An attacker can trigger the flaw by sending crafted network requests to the RRAS service, such as on a server configured as a VPN, dial-in, or routing endpoint; the CVSS vector (AV:N/PR:L/UI:N) indicates the attacker needs low-privilege access and no user interaction is required. Successful exploitation yields code execution with high confidentiality, integrity, and availability impact, giving the attacker unauthorized access to the victim machine. Only systems with RRAS enabled are affected — typically Windows Servers acting as VPN or remote-access/routing endpoints — because the role is optional and not installed by default. As of the September 2026 Patch Tuesday release there are no reports of in-the-wild exploitation, no known public proof-of-concept, and the CVE is not in CISA's KEV catalog, with EPSS estimating roughly a 0.9% probability of exploitation within 30 days.
· Microsoft Windows Routing and Remote Access Service (RRAS)large
Authenticated RCE in Windows Routing and Remote Access Service (RRAS)
CVE-2026-72959 is a heap-based buffer overflow (CWE-122) in Windows' Routing and Remote Access Service (RRAS) that can lead to remote code execution. It is triggered by sending crafted network traffic to the RRAS service on an affected host; per the CVSS vector, exploitation is network-based with low attack complexity, requires only low-privileged (authenticated) credentials, and needs no user interaction. A successful attacker gains the ability to execute code on the victim's machine and obtain unauthorized access, with high impact on confidentiality, integrity, and availability. Affected systems are Windows hosts with the RRAS role/service enabled, most commonly servers acting as VPN/remote-access gateways or routers. The flaw was disclosed in Microsoft's September 2026 Patch Tuesday; it is not yet in CISA KEV, no public proof-of-concept is known, and EPSS estimates only a 0.9% chance of exploitation within 30 days, so exploitation is plausible but not yet widely observed.
· Microsoft Windows Routing and Remote Access Service (RRAS)large
Heap-Based Buffer Overflow RCE in Microsoft Windows Imaging Component
CVE-2026-77495 is a heap-based buffer overflow (CWE-122) in the Windows Imaging Component (WIC), the Windows subsystem that decodes and processes image files. The CVSS vector (AV:N/PR:N/UI:R) indicates an unauthenticated remote attacker can exploit it, but only with user interaction — typically by getting a user to open, view or preview a crafted image that WIC then decodes, for example in a viewer or file-explorer thumbnail pane. Successful exploitation yields remote code execution with the privileges of the current user, with high impact on confidentiality, integrity and availability. Any Windows system that uses WIC to handle images is affected — effectively the entire installed Windows base — and the flaw was fixed in Microsoft's September 2026 Patch Tuesday. It is not yet known to be exploited in the wild: there is no public proof-of-concept, it is absent from CISA's KEV catalog, and EPSS puts 30-day exploitation probability at about 0.6%.
· Microsoft Windows Imaging Component (shipped with Windows operating systems) Windows versions addressed in the September 2026 security updates (specific version ranges not enumerated in the available data; all affected Windows editions rmass
Use-After-Free Remote Code Execution in Windows DNS Server
CVE-2026-69858 is a use-after-free memory-corruption flaw (CWE-416) in the Windows DNS Server component, addressed by Microsoft in the September 2026 Patch Tuesday release. An unauthorized remote attacker who can send crafted DNS traffic to an affected Windows DNS server can trigger the flaw, in which memory is freed while still in use, potentially corrupting it. Successful exploitation yields arbitrary code execution on the DNS server, though the network-accessible attack carries High attack complexity (CVSS 3.1 8.1, AV:N/AC:H/PR:N/UI:N), indicating reliable exploitation is harder to achieve. Affected are any organizations running the DNS Server role on Windows Server, which is nearly universal on Active Directory domain controllers and common on standalone and internet-facing DNS servers. As of the available data there is no public proof-of-concept, the issue is not in CISA KEV, and EPSS assigns a 0.7% probability of exploitation within 30 days, so no confirmed in-the-wild exploitation is known.
· Microsoft Windows DNS Server (DNS Server role on Windows Server)mass
Use-after-free RCE in Microsoft Windows Reliable Multicast Transport Driver (RMCAST)
CVE-2026-78449 is a use-after-free flaw (CWE-416) in Microsoft's Reliable Multicast Transport Driver (RMCAST, rmcast.sys), the Windows driver that implements the PGM reliable multicast transport used by features such as Message Queuing (MSMQ). An unauthorized remote attacker could trigger it by sending crafted network traffic that causes the driver to access freed memory, although the high attack complexity (CVSS AC:H) means exploitation depends on favorable timing or state conditions. Successful exploitation would allow arbitrary code execution in the context of the driver, with high impact on confidentiality, integrity, and availability (CVSS 3.1 score 8.1, High). Only systems running the affected RMCAST driver - typically Windows hosts where the optional Reliable Multicast Protocol/MSMQ multicast capability is installed, enabled, and network-reachable - are exposed; the specific affected Windows versions are enumerated in Microsoft's September 2026 Patch Tuesday release. As of now there is no known public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS assigns it a low 0.5% probability of exploitation within 30 days, so exploitation has not yet been observed.
· Microsoft Windows - Reliable Multicast Transport Driver (RMCAST / rmcast.sys)large
Use-After-Free RCE in Microsoft Windows Reliable Multicast Transport Driver (RMCAST)
CVE-2026-78450 is a use-after-free (CWE-416) in Microsoft's Reliable Multicast Transport Driver (RMCAST), the Windows networking component that handles reliable multicast transport traffic. An unauthenticated attacker can trigger the flaw by sending crafted network packets to a host running the affected driver; the high-attack-complexity rating (AV:N/AC:H) indicates exploitation depends on atypical conditions rather than a trivially reproducible request. Successful exploitation results in remote code execution on the target system. Any Windows system with the RMCAST driver loaded and reachable over the network is potentially affected; the reviewed data does not list specific Windows version ranges, and fixes were delivered in Microsoft's September 2026 Patch Tuesday. No public proof-of-concept or in-the-wild exploitation is currently known, and EPSS assigns only about a 0.5% probability of exploitation in the next 30 days.
· Microsoft Windows Reliable Multicast Transport Driver (RMCAST)mass
Heap-based Buffer Overflow in Microsoft Excel Enables Local Code Execution
CVE-2026-81951 is a heap-based buffer overflow (CWE-122) in Microsoft Excel, the spreadsheet component of Microsoft Office and Microsoft 365. Per the CVSS vector (AV:L with UI:R and no privileges required), exploitation requires user interaction, most plausibly a user opening a crafted spreadsheet, rather than any network-reachable service. Successful exploitation lets an unauthorized attacker execute arbitrary code locally, with the CVSS scoring high impact on confidentiality, integrity, and availability. All supported Excel-bearing releases are affected: Microsoft 365 Apps/Microsoft 365, Office 2016, Office 2019, Office 2021, and Office 2024. No public proof of concept is known, the flaw is not in CISA's KEV, and EPSS estimates only a ~0.4% chance of exploitation within 30 days, indicating no known in-the-wild exploitation as of the September 2026 Patch Tuesday that shipped the fix.
· Microsoft Excel · Microsoft 365 Appsmass
Query Logic Flaw Enables Info Disclosure in Microsoft Discovery Studio
CVE-2026-62906 is an improper neutralization of special elements in data query logic (CWE-943, an SQL-injection-style flaw) in Microsoft Discovery Studio that allows an unauthorized attacker to disclose information over a network. It is remotely exploitable without authentication (AV:N/PR:N) but requires user interaction (UI:R), meaning a user must perform some action, such as clicking a crafted link or submitting crafted input, for the attack to succeed. Successful exploitation has a high impact on confidentiality, potentially exposing sensitive data, while integrity and availability are unaffected. Any organization running Microsoft Discovery Studio is potentially affected, and Microsoft addressed the issue as part of the September 2026 Patch Tuesday security updates. There is currently no known public proof-of-concept, no inclusion in CISA's Known Exploited Vulnerabilities catalog, and EPSS estimates only a 0.7% probability of exploitation in the next 30 days, so no active exploitation is known at this time.
· Microsoft Discovery Studio—