Microsoft Patch Tuesday addresses 112 defects, including one actively exploited zero
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-20805 | Local Information Disclosure in Microsoft Desktop Windows Manager (CVE-2026-20805) | 5.5 | 7% | KEVPoC | KEV |
| CVE-2026-20868 | Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network | 8.8 | 1% | ||
CVE-2026-20952+2 related CVEs | Use after free in Microsoft Office allows an unauthorized attacker to execute code locally | 8.4 group max | <1% | ||
| CVE-2026-20947 | Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to execute… | 8.8 | 19% | ||
| CVE-2026-20963 | Deserialization RCE in Microsoft SharePoint Exploited in the Wild | 9.8 | 29% | KEV | KEV |
From the original article
3 min read at cyberscoop.com
Researchers said the information disclosure zero-day exposes sensitive information that attackers can use to undermine defenses and make other exploits more reliable. Microsoft’s first security update of 2026 addressed 112 vulnerabilities affecting its products and underlying systems, including one actively exploited zero-day in Desktop Window Manager.
By @CyberScoopNews · cyberscoop.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.