Microsoft QUIC

Related CVEsby mentions

• CVE-2026-550409.151%
  Authentication Bypass in Microsoft SharePoint Server
  Microsoft SharePoint Server is affected by a weak authentication vulnerability (CWE-1390) that allows an unauthorized attacker to bypass a security feature over a network. Per the CVSS vector, exploitation requires no privileges and no user interaction with low attack complexity, so any unauthenticated attacker with network access to a vulnerable server can trigger it remotely. Impact to confidentiality and integrity is rated high (CVSS 9.1, critical), meaning the bypass effectively grants the attacker access that authentication should have prevented, with no direct availability impact. All organizations running on-premises Microsoft SharePoint Server are potentially affected; the source data does not specify affected version ranges or fixed builds, so defenders should consult Microsoft's advisory for those details. The flaw is under active exploitation: a public proof-of-concept is available on GitHub, attackers began exploiting it after the PoC went public, and CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-18 (EPSS ~40%, 99th percentile; ransomware association unknown).
  · Microsoft SharePoint Server KEV PoC ×2mass
• CVE-2026-688207.06%
  Use-After-Free Local Privilege Escalation in Microsoft Windows WinSock AFD Driver
  CVE-2026-68820 is a use-after-free (CWE-416) in the Windows Ancillary Function Driver for WinSock (afd.sys), the kernel component that handles Winsock socket operations. A local, authenticated attacker can trigger the memory corruption through crafted socket activity, and the high attack-complexity score (AV:L/AC:H/PR:L) indicates exploitation requires a specific, likely race-sensitive sequence of operations. Successful exploitation elevates privileges to SYSTEM, giving the attacker full control of the host, and public reporting describes deployment of a backdoor after privilege escalation. Virtually every Windows 10, Windows 11, and Windows Server (2012-2022) installation ships this driver, so the affected population is essentially the entire supported Windows installed base. The flaw is being exploited in the wild: CISA added it to the KEV on 2026-08-11, Microsoft fixed it in the August 2026 Patch Tuesday release, and reporting ties active exploitation to North Korea's Lazarus group, who paired the zero-day with fake job-offer lures.
  · Microsoft Windows Ancillary Function Driver for WinSock (afd.sys) as shipped with the Windows versions listed below · Microsoft Windows 10 1607, 1809, 21H2, 22H2 KEVmass
• CVE-2026-628789.81%
  Unauthenticated Stack Buffer Overflow RCE in Windows DNS (CVE-2026-62878)
  Windows DNS contains a stack-based buffer overflow (CWE-121) that an unauthenticated, network-adjacent or internet-reachable attacker can trigger by sending crafted input to the DNS service. Successful exploitation yields remote code execution on the target host, with high impact on confidentiality, integrity and availability (CVSS 3.1: 9.8). The flaw affects the DNS component shipped with Windows 10 1607 and 1809 and with Windows Server 2012, 2016, 2019, 2022 and 2025; systems running the DNS Server role, especially internet-facing DNS servers and domain controllers, are the primary targets. Microsoft, which assigned the CVE, has issued a fix, and the flaw appeared amid a record-sized run of Patch Tuesday releases. No in-the-wild exploitation is currently known: it is not in CISA's KEV, no public proof-of-concept is available, and EPSS estimates only a 1.3% probability of exploitation within 30 days.
  · microsoft Windows 10 1607 · microsoft Windows 10 1809mass
• CVE-2026-628159.81%
  Use-after-free RCE in Microsoft MsQuic via crafted network packets
  A use-after-free (CWE-416) in Microsoft's QUIC implementation (MsQuic) allows an unauthenticated remote attacker to execute code on an affected host. The flaw arises because creating and removing new network paths in response to incoming packets can invalidate a pointer that is subsequently used. An attacker needs only to send a specially crafted packet to a service speaking QUIC, with no authentication or user interaction required; the maximum CVSS 4.0 score of 10 (critical) reflects full system-compromise potential. Any deployment of the MsQuic library is affected, including services built on Microsoft's in-box QUIC support (e.g., HTTP/3 and SMB over QUIC) and applications consuming the public NuGet package, though exact affected version ranges are not specified in the available data. Exploitation has not been observed: there is no public proof-of-concept, the issue is not in CISA's KEV, and EPSS puts the 30-day exploitation probability at about 1 percent, but a fix ('Guard path promotion', commit e0f55b5) is already available.
  · Microsoft MsQuic (Microsoft QUIC library; distributed via NuGet) · Microsoft Services and applications using MsQuic (e.g., HTTP/3, SMB over QUIC, .NET System.Net.Quic)mass
• CVE-2026-635208.13%
  Unauthenticated RCE in Microsoft SharePoint Server
  CVE-2026-63520 is an improper input validation flaw (CWE-20) in Microsoft Office SharePoint, affecting on-premises SharePoint Server deployments. A remote, unauthenticated attacker can trigger the flaw by sending improperly validated input to the SharePoint service over the network; the high attack complexity (AC:H) indicates exploitation depends on specific conditions, but no privileges or user interaction are required. Successful exploitation results in arbitrary code execution on the server, with high impact to confidentiality, integrity, and availability — effectively full compromise of the SharePoint host. Organizations running self-hosted SharePoint Server are in scope; SharePoint Online/Microsoft 365 is not listed in the affected products. The issue is patched as of Microsoft's Patch Tuesday (headlines mark it FIXED), with Rapid7 analysis and a researcher-disclosed exploit chain available, but there is no public PoC, no CISA KEV listing, and no confirmed in-the-wild exploitation; EPSS puts exploitation probability at 2.9% (86th percentile).
  · Microsoft SharePoint Server (Office SharePoint, on-premises)mass
• CVE-2026-591249.82%
  Unauthenticated Deserialization RCE in Microsoft HPC Pack
  CVE-2026-59124 is a deserialization of untrusted data flaw (CWE-502) in Microsoft High Performance Computing (HPC) Pack that allows an unauthorized attacker to execute code over a network. Because the vulnerable component processes untrusted serialized input, an attacker who can reach the network-facing service can send malicious serialized data and trigger arbitrary code execution without credentials or user interaction. Successful exploitation grants the attacker the ability to run code in the context of the affected service, with full confidentiality, integrity, and availability impact per the 9.8 CVSS score. Any organization running Microsoft HPC Pack on Windows — typically head nodes and management endpoints of Windows HPC clusters — is affected. As of the August 2026 Patch Tuesday release that addressed it, there is no known public proof-of-concept, no CISA KEV listing, and no confirmed exploitation in the wild, though the EPSS score of 1.7% (76th percentile) suggests a moderate near-term exploitation probability.
  · Microsoft HPC Pack (High Performance Computing Pack) on Windowsniche
• CVE-2026-628939.83%
  Pre-auth use-after-free RCE in Microsoft Windows Deployment Services (WDS)
  Microsoft Windows Deployment Services (WDS) contains a use-after-free memory-safety flaw (CWE-416) that an unauthenticated attacker can trigger by sending crafted network traffic to the WDS service, leading to remote code execution on the target system. The vulnerability affects Windows 10 1607 and 1809 and Windows Server 2012, 2016, 2019, 2022, and 2025 on systems where WDS is deployed, a role typically used for network-based (PXE) operating system imaging. A successful exploit grants the attacker code execution with high confidentiality, integrity, and availability impact, reflected in the critical CVSS 3.1 score of 9.8 with network vector, low complexity, and no privileges or user interaction required. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is currently known, although EPSS estimates a 2.7% probability of exploitation within 30 days (85th percentile). The flaw was disclosed alongside Microsoft's record September 2026 Patch Tuesday, which shipped nearly 1,000 fixes including two Windows zero-days.
  · microsoft Windows 10 1607 · microsoft Windows 10 1809large
• CVE-2026-628327.83%
  Local Privilege Escalation via Link Following in Windows User Profile Service
  CVE-2026-62832 is a local privilege escalation flaw (CWE-59, improper link resolution, or 'link following') in the Windows User Profile Service. An attacker who already holds a limited local account on an affected machine can cause the service to follow a symbolic link or junction before it validates file access, so the service performs file operations with elevated rights. Successful exploitation grants elevated privileges on the local system — typically up to administrator/SYSTEM level — with no user interaction required. Affected platforms include Windows 10 21H2 and 22H2, Windows 11 23H2 through 26H1, and Windows Server 2022 and 2025, which together span essentially the entire supported Windows estate. As of this analysis there is no public proof-of-concept, no CISA KEV listing, and no confirmed in-the-wild exploitation of this specific flaw; EPSS estimates a 3.3% (88th percentile) chance of exploitation within 30 days, although Microsoft's August 2026 Patch Tuesday fixed 400+ vulnerabilities and a separate zero-day (CVE-2026-68820) is under active attack.
  · microsoft Windows 10 21H2 · microsoft Windows 10 22H2mass
• CVE-2026-506567.011%
  Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "RoguePlanet ".
  Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "RoguePlanet ".
  · microsoft malware protection engine PoC —
• CVE-2026-729715.5<1%
  Local Tampering via Link-Following Flaw in Windows 11 26H1 Container Isolation Driver
  CVE-2026-72971 is a link-following flaw (CWE-59) in the Windows Container Isolation FS Filter Driver (unionfs.sys) on Windows 11 26H1: the driver performs file access without fully verifying that the path is not redirected through a symbolic link or junction. A local attacker who already holds low-privilege access (CVSS AV:L/PR:L, no user interaction required) can plant a malicious link at a location the driver processes, causing it to follow the link and act on an attacker-chosen target. The attacker gains tampering capability, which the CVSS scores as High integrity impact with no confidentiality or availability impact, meaning they can modify or overwrite files their account could not normally change. Any Windows 11 26H1 system is in scope per the CVE data, with the highest practical risk on shared or multi-user hosts and machines using container isolation features where unionfs.sys is active. No active exploitation is known: the CVE is not in CISA KEV, no public proof-of-concept exists, and EPSS puts 30-day exploitation probability at about 0.5%; the related news shows Microsoft's August 2026 Patch Tuesday shipped 400+ fixes, and defenders should confirm their devices received the unionfs.sys patch.
  · microsoft Windows 11 26H1 (Container Isolation FS Filter Driver, unionfs.sys)mass

Appears with