cve.bz

Microsoft Patch Tuesday, September 2026: the CVEs

Filter

Microsoft Patch Tuesday September 2026: the CVEs Microsoft published on 8 September 2026, the second Tuesday of the month, with CVSS, EPSS, CISA KEV and public exploits to show what to patch first. Narrow it: in CISA KEV · critical. The same day: Adobe, SAP. Earlier: Aug 2026, Jul 2026, Jun 2026, May 2026, Apr 2026, Mar 2026, Feb 2026, Jan 2026, Dec 2025, Nov 2025, Oct 2025, Sep 2025. Other lists: CISA KEV list, CVE exploit search, Latest critical CVEs, Ransomware CVEs, New CVEs today, This week, Patch Tuesday

  1. 8.3CVE-2026-69646EPSS 0.3%

    Improper verification of cryptographic signature in Skype for Business allows an unauthorized attacker to perform spoofing over an adjacent network.

  2. 6.1CVE-2026-69642EPSS 0.4%

    Improper neutralization of input during web page generation ('cross-site scripting') in Skype for Business allows an unauthorized attacker to perform spoofing over a network.

  3. 6.5CVE-2026-66308EPSS 1.1%

    Out-of-bounds read in Skype for Business allows an authorized attacker to deny service over a network.

  4. 7.5CVE-2026-66307EPSS 1.2%

    Integer underflow (wrap or wraparound) in Skype for Business allows an unauthorized attacker to deny service over a network.

  5. 6.5CVE-2026-66306EPSS 0.9%

    Generation of error message containing sensitive information in Skype for Business allows an unauthorized attacker to disclose information over a network.

  6. 7.1CVE-2026-66305EPSS 0.5%

    Use of client-side authentication in Skype for Business allows an authorized attacker to perform spoofing over a network.

  7. 7.5CVE-2026-66304EPSS 1.0%

    Server-side request forgery (ssrf) in Skype for Business allows an unauthorized attacker to disclose information over a network.

  8. 6.5CVE-2026-66303EPSS 1.1%

    Null pointer dereference in Skype for Business allows an authorized attacker to deny service over a network.

  9. 9.8CVE-2026-66302EPSS 1.0%

    External control of file name or path in Skype for Business allows an unauthorized attacker to execute code over a network.

  10. 6.1CVE-2026-63523EPSS 0.6%

    Improper neutralization of input during web page generation ('cross-site scripting') in Skype for Business allows an unauthorized attacker to perform spoofing over a network.

  11. 7.8CVE-2026-85880KEVEPSS 0.4%

    Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally.

  12. 8.8CVE-2026-85877EPSS 0.8%

    Heap-based buffer overflow in Windows Print Spooler Components allows an unauthorized attacker to execute code over a network.

  13. 5.5CVE-2026-85875EPSS 0.5%

    Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

  14. 7.0CVE-2026-85360EPSS 0.3%

    Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

  15. 7.4CVE-2026-84003EPSS 0.6%

    Authentication bypass by capture-replay in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to perform spoofing over a network.

  16. 7.5CVE-2026-84001EPSS 1.2%

    Out-of-bounds read in Windows Key Distribution Center allows an unauthorized attacker to deny service over a network.

  17. 7.8CVE-2026-84000EPSS 0.3%

    Heap-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to execute code locally.

  18. 7.0CVE-2026-83999EPSS 0.3%

    Improper link resolution before file access ('link following') in Windows Resilient File System (ReFS) Deduplication Service allows an authorized attacker to elevate privileges locally.

  19. 8.8CVE-2026-83998EPSS 0.8%

    Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

  20. 8.1CVE-2026-83997EPSS 0.7%

    Use after free in Windows Message Queuing allows an unauthorized attacker to execute code over a network.

  21. 8.8CVE-2026-83996EPSS 0.3%

    Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges locally.

  22. 7.8CVE-2026-83995EPSS 0.3%

    Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally.

  23. 8.8CVE-2026-83992EPSS 0.8%

    Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code over a network.

  24. 5.5CVE-2026-83991EPSS 0.3%

    Missing authentication for critical function in Windows Cloud Files Mini Filter Driver allows an authorized attacker to perform tampering locally.

  25. 7.8CVE-2026-83990EPSS 0.3%

    Stack-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.

  26. 7.5CVE-2026-83989EPSS 1.2%

    Out-of-bounds read in Windows Services for NFS ONCRPC XDR Driver allows an unauthorized attacker to deny service over a network.

  27. 7.8CVE-2026-83988EPSS 0.3%

    Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  28. 7.8CVE-2026-83987EPSS 0.3%

    Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  29. 7.8CVE-2026-83986EPSS 0.3%

    Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  30. 7.8CVE-2026-83985EPSS 0.3%

    Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  31. 7.8CVE-2026-83983EPSS 0.3%

    Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  32. 7.8CVE-2026-83982EPSS 0.3%

    Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  33. 7.8CVE-2026-83981EPSS 0.3%

    Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  34. 7.8CVE-2026-83980EPSS 0.3%

    Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  35. 7.8CVE-2026-83979EPSS 0.3%

    Use after free in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  36. 7.8CVE-2026-83978EPSS 0.3%

    Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  37. 7.8CVE-2026-83977EPSS 0.3%

    Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  38. 7.8CVE-2026-83976EPSS 0.3%

    Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  39. 7.8CVE-2026-83975EPSS 0.3%

    Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  40. 7.8CVE-2026-83974EPSS 0.3%

    Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  41. 7.8CVE-2026-83973EPSS 0.3%

    Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  42. 7.8CVE-2026-83972EPSS 0.3%

    Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  43. 7.8CVE-2026-83971EPSS 0.3%

    Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  44. 7.8CVE-2026-83970EPSS 0.3%

    Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  45. 7.8CVE-2026-83969EPSS 0.3%

    Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  46. 7.8CVE-2026-83968EPSS 0.3%

    Use after free in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  47. 7.8CVE-2026-83967EPSS 0.3%

    Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  48. 7.8CVE-2026-83955EPSS 0.3%

    Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  49. 7.8CVE-2026-83954EPSS 0.3%

    Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  50. 7.8CVE-2026-83952EPSS 0.3%

    Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an authorized attacker to elevate privileges locally.

  51. 5.5CVE-2026-83951EPSS 0.5%

    Buffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information locally.

  52. 5.5CVE-2026-83949EPSS 0.5%

    Buffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information locally.

  53. 8.0CVE-2026-83948EPSS 0.6%

    Improper neutralization of special elements used in a command ('command injection') in Microsoft Azure CLI allows an authorized attacker to execute code over a network.

  54. 7.8CVE-2026-83942EPSS 0.3%

    Missing authorization in Windows Kernel allows an authorized attacker to elevate privileges locally.

  55. 8.8CVE-2026-83941EPSS 0.8%

    Missing authorization in Entra ID allows an authorized attacker to elevate privileges over a network.

  56. 7.0CVE-2026-83940EPSS 0.3%

    Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally.

  57. 8.2CVE-2026-83939EPSS 0.3%

    Untrusted pointer dereference in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally.

  58. 5.5CVE-2026-83501EPSS 0.4%

    Out-of-bounds read in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to disclose information locally.

  59. 7.8CVE-2026-83498EPSS 0.3%

    Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.

  60. 7.8CVE-2026-81963KEVEPSS 7.1%

    Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally.

  61. 7.8CVE-2026-81960EPSS 0.5%

    Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  62. 7.8CVE-2026-81959EPSS 0.5%

    Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  63. 5.5CVE-2026-81958EPSS 0.5%

    Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

  64. 7.8CVE-2026-81957EPSS 0.5%

    Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  65. 7.8CVE-2026-81956EPSS 0.5%

    Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  66. 8.8CVE-2026-81955EPSS 0.8%

    Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network.

  67. 7.8CVE-2026-81954EPSS 0.5%

    Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  68. 7.8CVE-2026-81953EPSS 0.5%

    Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  69. 8.8CVE-2026-81952EPSS 0.8%

    Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

  70. 7.8CVE-2026-81951EPSS 0.5%

    Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  71. 7.8CVE-2026-81950EPSS 0.5%

    Double free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  72. 7.8CVE-2026-81949EPSS 0.5%

    Integer overflow or wraparound in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  73. 7.8CVE-2026-81948EPSS 0.5%

    Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  74. 7.8CVE-2026-81947EPSS 0.5%

    Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  75. 5.5CVE-2026-81401EPSS 0.5%

    Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

  76. 5.5CVE-2026-81400EPSS 0.5%

    Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

  77. 5.5CVE-2026-81399EPSS 0.5%

    Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

  78. 7.8CVE-2026-81398EPSS 0.5%

    Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  79. 7.8CVE-2026-81397EPSS 0.5%

    Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  80. 7.8CVE-2026-81396EPSS 0.5%

    Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  81. 5.5CVE-2026-81395EPSS 0.5%

    Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

  82. 5.5CVE-2026-81394EPSS 0.6%

    Exposure of sensitive system information to an unauthorized control sphere in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

  83. 5.5CVE-2026-81393EPSS 0.5%

    Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

  84. 5.5CVE-2026-81392EPSS 0.5%

    Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

  85. 5.5CVE-2026-81391EPSS 0.5%

    Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

  86. 5.5CVE-2026-81390EPSS 0.5%

    Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

  87. 7.0CVE-2026-81389EPSS 0.4%

    Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  88. 7.8CVE-2026-81388EPSS 0.5%

    Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  89. 5.5CVE-2026-81387EPSS 0.6%

    Exposure of sensitive system information to an unauthorized control sphere in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

  90. 7.8CVE-2026-81386EPSS 0.5%

    Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  91. 8.8CVE-2026-81385EPSS 1.3%

    Deserialization of untrusted data in Microsoft Office Publisher allows an unauthorized attacker to execute code over a network.

  92. 7.4CVE-2026-81383EPSS 0.9%

    Use of incorrectly-resolved name or reference in Visual Studio Code allows an unauthorized attacker to disclose information over a network.

  93. 7.5CVE-2026-81381EPSS 0.9%

    Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network.

  94. 5.9CVE-2026-81380EPSS 0.7%

    Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network.

  95. 8.2CVE-2026-81379EPSS 0.5%

    Not failing securely ('failing open') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

  96. 8.2CVE-2026-81378EPSS 0.5%

    Interpretation conflict in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

  97. 6.5CVE-2026-81377EPSS 0.8%

    Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to perform tampering over a network.

  98. 9.6CVE-2026-81376EPSS 0.9%

    Incomplete comparison with missing factors in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

  99. 8.2CVE-2026-81357EPSS 0.5%

    Server-side request forgery (ssrf) in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

  100. 8.2CVE-2026-81356EPSS 0.5%

    Inconsistent interpretation of http requests ('http request/response smuggling') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.