Microsoft Patch Tuesday matches last year’s zero-day high with six actively exploited vulnerabilities
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-21510+4 related CVEs | Security Feature Bypass in Microsoft Windows Shell Actively Exploited (CVE-2026-21510) | 8.8 group max | 61% | KEV | KEV |
| CVE-2026-21514 | Actively Exploited Security Feature Bypass in Microsoft Word (CVE-2026-21514) | 7.8 | 2% | KEV | KEV |
| CVE-2026-21531 | Deserialization of untrusted data in Azure SDK allows an unauthorized attacker to execute code over a network | 9.8 | 2% | ||
| CVE-2026-24300 | Azure Front Door Elevation of Privilege Vulnerability | 9.8 | 1% |
From the original article
3 min read at cyberscoop.com
Microsoft said three of the exploited vulnerabilities were publicly known, suggesting attackers already had details about the defects prior to Tuesday’s release. Microsoft’s latest security update is littered with zero-day vulnerabilities, actively exploited defects that account for more than 10% of the total CVEs the vendor addressed in this month’s Patch Tuesday update .
By @CyberScoopNews · cyberscoop.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.