cve.bz

Microsoft Patch Tuesday, September 2026: the CVEs, page 10

Filter

Microsoft Patch Tuesday September 2026: the CVEs Microsoft published on 8 September 2026, the second Tuesday of the month, with CVSS, EPSS, CISA KEV and public exploits to show what to patch first. Narrow it: in CISA KEV · critical. The same day: Adobe, SAP. Earlier: Aug 2026, Jul 2026, Jun 2026, May 2026, Apr 2026, Mar 2026, Feb 2026, Jan 2026, Dec 2025, Nov 2025, Oct 2025, Sep 2025. Other lists: CISA KEV list, CVE exploit search, Latest critical CVEs, Ransomware CVEs, New CVEs today, This week, Patch Tuesday

  1. 6.5CVE-2026-68778EPSS 1.0%

    Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.

  2. 6.5CVE-2026-68777EPSS 1.0%

    Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.

  3. 6.5CVE-2026-68776EPSS 1.0%

    Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network.

  4. 8.8CVE-2026-68775EPSS 0.9%

    Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.

  5. 6.5CVE-2026-67648EPSS 1.0%

    Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network.

  6. 6.5CVE-2026-67645EPSS 1.0%

    Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.

  7. 9.8CVE-2026-67643EPSS 1.0%

    Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network.

  8. 8.8CVE-2026-67642EPSS 0.9%

    Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.

  9. 6.5CVE-2026-67641EPSS 1.1%

    Integer overflow or wraparound in SQL Server allows an authorized attacker to deny service over a network.

  10. 8.8CVE-2026-67639EPSS 0.9%

    Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.

  11. 8.8CVE-2026-67638EPSS 0.9%

    Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.

  12. 9.0CVE-2026-67636EPSS 0.7%

    Out-of-bounds read in SQL Server allows an unauthorized attacker to execute code over a network.

  13. 6.5CVE-2026-67633EPSS 1.1%

    Out-of-bounds read in SQL Server allows an authorized attacker to deny service over a network.

  14. 9.8CVE-2026-67631EPSS 1.0%

    Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network.

  15. 6.5CVE-2026-67630EPSS 1.0%

    Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.

  16. 6.5CVE-2026-67629EPSS 1.0%

    Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.

  17. 6.5CVE-2026-67624EPSS 1.0%

    Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.

  18. 6.5CVE-2026-67393EPSS 1.0%

    Buffer over-read in SQL Server allows an authorized attacker to disclose information over a network.

  19. 6.5CVE-2026-67390EPSS 1.0%

    Buffer over-read in SQL Server allows an authorized attacker to disclose information over a network.

  20. 6.5CVE-2026-67389EPSS 1.0%

    Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.

  21. 8.8CVE-2026-67388EPSS 0.9%

    Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.

  22. 6.5CVE-2026-67386EPSS 1.0%

    Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network.

  23. 8.8CVE-2026-67385EPSS 0.9%

    Use after free in SQL Server allows an authorized attacker to execute code over a network.

  24. 8.8CVE-2026-67384EPSS 0.9%

    Integer overflow or wraparound in SQL Server allows an authorized attacker to execute code over a network.

  25. 6.5CVE-2026-67383EPSS 1.0%

    Generation of error message containing sensitive information in SQL Server allows an authorized attacker to disclose information over a network.

  26. 8.8CVE-2026-67381EPSS 0.9%

    Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network.

  27. 8.8CVE-2026-67380EPSS 0.9%

    Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.

  28. 8.5CVE-2026-67379EPSS 0.7%

    Stack-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.

  29. 9.0CVE-2026-67378EPSS 0.7%

    Untrusted pointer dereference in SQL Server allows an unauthorized attacker to execute code over a network.

  30. 7.5CVE-2026-67376EPSS 1.2%

    Integer overflow or wraparound in SQL Server allows an unauthorized attacker to deny service over a network.

  31. 8.8CVE-2026-67373EPSS 0.9%

    Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.

  32. 8.8CVE-2026-67370EPSS 1.0%

    Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

  33. 6.5CVE-2026-67369EPSS 1.0%

    Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.

  34. 8.8CVE-2026-67368EPSS 1.0%

    Improper link resolution before file access ('link following') in SQL Server allows an authorized attacker to elevate privileges over a network.

  35. 8.8CVE-2026-66820EPSS 1.0%

    Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

  36. 8.8CVE-2026-66819EPSS 1.0%

    Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

  37. 8.8CVE-2026-66818EPSS 0.8%

    Improper privilege management in SQL Server allows an authorized attacker to elevate privileges over a network.

  38. 6.5CVE-2026-66816EPSS 1.0%

    Insufficient logging in SQL Server allows an authorized attacker to bypass a security feature over a network.

  39. 8.8CVE-2026-66814EPSS 0.8%

    Insufficient granularity of access control in SQL Server allows an authorized attacker to elevate privileges over a network.

  40. 6.8CVE-2026-65812EPSS 0.9%

    Insertion of sensitive information into sent data in Microsoft Teams for Android allows an authorized attacker to disclose information over a network.

  41. 8.8CVE-2026-65772EPSS 1.7%

    Deserialization of untrusted data in Microsoft Dynamics 365 allows an authorized attacker to execute code over a network.

  42. 9.6CVE-2026-65669EPSS 0.9%

    Improper neutralization of special elements in output used by a downstream component ('injection') in SQL Server allows an unauthorized attacker to elevate privileges over a network.

  43. 6.5CVE-2026-64918EPSS 0.9%

    Insufficiently protected credentials in Microsoft Office allows an unauthorized attacker to perform spoofing over a network.

  44. 8.8CVE-2026-62895EPSS 0.8%

    Permissive cross-domain policy with untrusted domains in Azure Arc allows an unauthorized attacker to elevate privileges over a network.

  45. 7.5CVE-2026-62813EPSS 0.7%

    Use after free in Active Directory Domain Services allows an authorized attacker to execute code over a network.

  46. 7.8CVE-2026-62810EPSS 0.3%

    Heap-based buffer overflow in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges locally.

  47. 7.8CVE-2026-62804EPSS 0.6%

    External control of file name or path in Microsoft Office Word allows an unauthorized attacker to execute code locally.

  48. 6.5CVE-2026-62801EPSS 0.8%

    Improper limitation of a pathname to a restricted directory ('path traversal') in Windows PowerShell allows an unauthorized attacker to bypass a security feature over a network.

  49. 6.5CVE-2026-62762EPSS 1.1%

    Null pointer dereference in Active Directory Domain Services allows an authorized attacker to deny service over a network.

  50. 7.5CVE-2026-62759EPSS 0.4%

    Authentication bypass by spoofing in Windows Netlogon allows an unauthorized attacker to perform spoofing over an adjacent network.

  51. 8.8CVE-2026-62744EPSS 0.8%

    Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.

  52. 8.8CVE-2026-62706EPSS 0.8%

    Out-of-bounds read in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.

  53. 7.8CVE-2026-62697EPSS 0.3%

    Use after free in Windows Push Notifications allows an authorized attacker to elevate privileges locally.

  54. 7.0CVE-2026-62694EPSS 0.3%

    Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.

  55. 6.5CVE-2026-58649EPSS 0.4%

    Origin validation error in .NET allows an unauthorized attacker to disclose information over a network.

  56. 7.8CVE-2026-58611EPSS 0.3%

    Improper authorization in XBox Gaming Services allows an authorized attacker to elevate privileges locally.

  57. 7.8CVE-2026-58600EPSS 0.5%

    Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to elevate privileges locally.

  58. 7.8CVE-2026-58599EPSS 0.5%

    Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code locally.

  59. 7.5CVE-2026-57099EPSS 1.2%

    Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

  60. 7.5CVE-2026-57098EPSS 0.6%

    Improper verification of cryptographic signature in Windows RDP Client allows an unauthorized attacker to disclose information over a network.

  61. 7.8CVE-2026-56198EPSS 0.3%

    Out-of-bounds read in Microsoft Trace Data Helper allows an authorized attacker to elevate privileges locally.

  62. 7.8CVE-2026-56177EPSS 0.3%

    Use after free in Windows Server allows an authorized attacker to elevate privileges locally.

  63. 7.8CVE-2026-56172EPSS 0.3%

    Use after free in Windows VHD miniport driver allows an authorized attacker to elevate privileges locally.

  64. 8.1CVE-2026-55007EPSS 0.7%

    Double free in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network.

  65. 7.0CVE-2026-50349EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

  66. 8.1CVE-2026-47297EPSS 1.1%

    Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network.