30
35
35
30
Windows BitLocker Vulnerability Allows Attackers to Execute Malicious Code Remotely
Microsoft patched CVE-2026-69449, a heap-based buffer overflow in Windows BitLocker enabling code execution, affecting Windows 10/11 and Server 2012-2025 in September 2026 updates.
Microsoft disclosed CVE-2026-69449, a heap-based buffer overflow in Windows BitLocker rated Important, which could allow an authorized attacker to execute arbitrary code locally, with possible in-network exploitation via arbitrary endpoint calls. Microsoft rates exploitation as Less Likely and there was no public disclosure or in-the-wild exploitation at release. The flaw affects Windows 10 (1607-22H2), Windows 11 (23H2-26H1), and Windows Server 2012 through 2025, including Server Core. Fixes shipped in the September 2026 Patch Tuesday cumulative updates via platform-specific KBs such as KB5124012 and KB5122871.
50
35
30
30
30
35
35
35
50
35
30
35
35
35
Serial Microsoft 0-day hunter drops yet another Defender exploit
Researcher Nightmare Eclipse released ShieldCrash, a Microsoft Defender zero-day PoC that bypasses September patches and reads files as SYSTEM.
Zero-day researcher Nightmare Eclipse (MSNightmare) published ShieldCrash, their 11th Microsoft zero-day, a proof-of-concept bypass of the ShieldBreak patch (CVE-2026-69414), which itself had bypassed the fix for RoguePlanet (CVE-2026-50656). ShieldCrash works on Windows 10, Windows 11, and Windows Server systems that have applied the September 2026 patches and allows arbitrary file reads as SYSTEM, though not arbitrary writes or a full SYSTEM shell. Microsoft has not said when it plans to patch the issue. The researcher recently also released zero-days affecting CrowdStrike Falcon (FalconFlank), Kaspersky endpoint antivirus (HardBreacher, patched), and Gen Digital's Avast (PrettyPrague).
55
30
30
50
35
35
50
30
35
35
35
50
50
35
35
35
30
Researcher Releases FalconFlank PoC Showing Privilege Escalation in CrowdStrike Falcon
Researcher Chaotic Eclipse released FalconFlank, a zero-day privilege escalation PoC abusing CrowdStrike Falcon's Office macro remediation; CrowdStrike is investigating and issued a tech alert.
Researcher Chaotic Eclipse published FalconFlank, a proof-of-concept zero-day local privilege escalation in CrowdStrike Falcon Sensor that abuses the Microsoft Office malicious macros remediation feature, tested on fully updated Windows 11 25H2 and Windows Server 2025. CrowdStrike said it is investigating, advised disabling the Microsoft Office File Suspicious Macro Removal policy, and pointed customers to a FalconFlank tech alert, noting cloud anti-malware protection remains active. The article also covers related PoCs from the same researcher: HardBreacher against Kaspersky (fixed via update), ShieldBreak (CVE-2026-69414) against Microsoft Defender, an unpatched patch bypass of CVE-2026-50656, GreenSection against NVIDIA, and PrettyPrague against Avast, which Gen Digital patched in versions 26.7.11086 and 26.8.11125.
58
Microsoft Confirms KB5002914 Update Breaks Copy and Paste on Excel
Microsoft confirms KB5002914 Excel security update silently breaks copy-paste in Excel 2016-2024, forcing admins to choose between usability and security fixes.
Microsoft added a known issue to KB5002914, the September 8, 2026 Excel security update, where paste, autofill, and formula dragging fail silently with no error in Excel 2016, 2019, 2021, and 2024. The update addresses remote code execution and information disclosure flaws including CVE-2026-81399, CVE-2026-81390, and CVE-2026-81954. No hotfix date has been published as of September 15, 2026; the only widely confirmed recovery is uninstalling or rolling back KB5002914, which drops the month's Excel security fixes.
35
50
35
35