Microsoft’s monthly Patch Tuesday is first in 6 months with no actively exploited zero
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-21262 | Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network | 8.8 | 2% | ||
| CVE-2026-24294 | Improper authentication in Windows SMB Server allows an authorized attacker to elevate privileges locally | 7.8 group max | 5% | ||
CVE-2026-26113+2 related CVEs | Untrusted pointer dereference in Microsoft Office allows an unauthorized attacker to execute code locally | 7.8 group max | <1% | ||
| CVE-2026-26127 | Out-of-bounds read in .NET allows an unauthorized attacker to deny service over a network | 7.5 | 2% |
From the original article
3 min read at cyberscoop.com
The vendor said six of the 83 vulnerabilities it addressed this month are more likely to be exploited. A corporate logo for Microsoft hangs above the door to its office building on 8th Avenue on June 24, 2025, in New York City. (Photo by Gary Hershorn/Getty Images) Microsoft addressed 83 vulnerabilities that cut across its broad portfolio of enterprise software and underlying services in its latest security update.
By @CyberScoopNews · cyberscoop.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.