cve.bz

Microsoft Patch Tuesday, September 2026: the CVEs, page 3

Filter

Microsoft Patch Tuesday September 2026: the CVEs Microsoft published on 8 September 2026, the second Tuesday of the month, with CVSS, EPSS, CISA KEV and public exploits to show what to patch first. Narrow it: in CISA KEV · critical. The same day: Adobe, SAP. Earlier: Aug 2026, Jul 2026, Jun 2026, May 2026, Apr 2026, Mar 2026, Feb 2026, Jan 2026, Dec 2025, Nov 2025, Oct 2025, Sep 2025. Other lists: CISA KEV list, CVE exploit search, Latest critical CVEs, Ransomware CVEs, New CVEs today, This week, Patch Tuesday

  1. 7.8CVE-2026-77500EPSS 0.3%

    Release of invalid pointer or reference in Windows Device Association Service allows an authorized attacker to elevate privileges locally.

  2. 7.5CVE-2026-77499EPSS 1.2%

    Access of resource using incompatible type ('type confusion') in Windows DHCP Server allows an unauthorized attacker to deny service over a network.

  3. 7.5CVE-2026-77498EPSS 1.2%

    Out-of-bounds read in Windows DHCP Server allows an unauthorized attacker to deny service over a network.

  4. 8.8CVE-2026-77495EPSS 0.8%

    Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code over a network.

  5. 7.5CVE-2026-77494EPSS 1.2%

    Access of resource using incompatible type ('type confusion') in Windows DHCP Server allows an unauthorized attacker to deny service over a network.

  6. 9.8CVE-2026-77493EPSS 1.0%

    Double free in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network.

  7. 5.5CVE-2026-77492EPSS 0.4%

    Out-of-bounds read in Storage Port Driver allows an authorized attacker to disclose information locally.

  8. 5.5CVE-2026-77491EPSS 0.4%

    Out-of-bounds read in Windows GDI allows an unauthorized attacker to disclose information locally.

  9. 7.8CVE-2026-77489EPSS 0.3%

    Null pointer dereference in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  10. 5.5CVE-2026-77488EPSS 0.4%

    Integer underflow (wrap or wraparound) in SQL Server allows an authorized attacker to disclose information locally.

  11. 8.8CVE-2026-77487EPSS 0.8%

    Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.

  12. 8.8CVE-2026-77486EPSS 0.8%

    Integer overflow or wraparound in SQL Server allows an unauthorized attacker to execute code over a network.

  13. 7.0CVE-2026-77485EPSS 0.3%

    Use after free in SQL Server allows an authorized attacker to elevate privileges locally.

  14. 8.8CVE-2026-77484EPSS 1.7%

    Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network.

  15. 8.8CVE-2026-77483EPSS 0.8%

    Weak authentication in SQL Server allows an authorized attacker to elevate privileges over a network.

  16. 8.8CVE-2026-77482EPSS 0.8%

    Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network.

  17. 8.8CVE-2026-77481EPSS 0.9%

    Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.

  18. 8.8CVE-2026-77480EPSS 0.8%

    Insufficient granularity of access control in SQL Server allows an authorized attacker to elevate privileges over a network.

  19. 6.5CVE-2026-73029EPSS 1.0%

    Buffer over-read in SQL Server allows an authorized attacker to disclose information over a network.

  20. 8.8CVE-2026-73028EPSS 0.8%

    Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.

  21. 7.8CVE-2026-73026EPSS 0.3%

    Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  22. 9.8CVE-2026-73025EPSS 0.9%

    Weak authentication in Windows iSCSI allows an unauthorized attacker to bypass a security feature over a network.

  23. 7.8CVE-2026-73024EPSS 0.3%

    Heap-based buffer overflow in Windows Services for NFS ONCRPC XDR Driver allows an authorized attacker to elevate privileges locally.

  24. 8.8CVE-2026-73023EPSS 0.8%

    Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code over a network.

  25. 7.0CVE-2026-73022EPSS 0.3%

    Use after free in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.

  26. 7.8CVE-2026-73021EPSS 0.3%

    Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  27. 7.8CVE-2026-73020EPSS 0.3%

    Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  28. 4.3CVE-2026-73019EPSS 0.8%

    Improper resolution of path equivalence in Windows URL Moniker allows an unauthorized attacker to bypass a security feature over a network.

  29. 8.8CVE-2026-73018EPSS 0.8%

    Heap-based buffer overflow in Graphic Fonts allows an unauthorized attacker to execute code over a network.

  30. 7.5CVE-2026-73017EPSS 0.3%

    Heap-based buffer overflow in Windows Graphics Kernel allows an authorized attacker to execute code locally.

  31. 8.8CVE-2026-73016EPSS 0.8%

    Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network.

  32. 7.8CVE-2026-73015EPSS 0.3%

    Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  33. 7.8CVE-2026-73014EPSS 0.3%

    Missing authorization in Data Sharing Service Client allows an authorized attacker to elevate privileges locally.

  34. 8.8CVE-2026-73013EPSS 0.8%

    Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code over a network.

  35. 8.8CVE-2026-73012EPSS 0.9%

    Heap-based buffer overflow in Windows Management Services allows an authorized attacker to elevate privileges over a network.

  36. 7.8CVE-2026-73011EPSS 0.3%

    Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  37. 9.8CVE-2026-73010EPSS 1.0%

    Use after free in Windows Failover Cluster allows an unauthorized attacker to execute code over a network.

  38. 9.8CVE-2026-73009EPSS 1.0%

    Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized attacker to execute code over a network.

  39. 5.5CVE-2026-73008EPSS 0.5%

    Exposure of private personal information to an unauthorized actor in Windows Biometric Service allows an authorized attacker to disclose information locally.

  40. 7.8CVE-2026-73007EPSS 0.3%

    Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  41. 8.8CVE-2026-73006EPSS 0.8%

    Stack-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network.

  42. 7.0CVE-2026-73005EPSS 0.2%

    Use after free in Windows Authentication Methods allows an authorized attacker to elevate privileges locally.

  43. 5.5CVE-2026-73004EPSS 0.3%

    Missing authentication for critical function in Windows Autopilot allows an authorized attacker to perform tampering locally.

  44. 7.0CVE-2026-73003EPSS 0.3%

    Use after free in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.

  45. 7.8CVE-2026-73002EPSS 0.3%

    Integer overflow or wraparound in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  46. 7.8CVE-2026-73001EPSS 0.3%

    Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  47. 7.8CVE-2026-73000EPSS 0.3%

    Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  48. 6.8CVE-2026-72999EPSS 0.4%

    Out-of-bounds read in Windows USB Hub Driver allows an unauthorized attacker to elevate privileges with a physical attack.

  49. 7.8CVE-2026-72997EPSS 0.3%

    Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  50. 7.8CVE-2026-72996EPSS 0.3%

    Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  51. 7.8CVE-2026-72995EPSS 0.3%

    Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  52. 7.8CVE-2026-72994EPSS 0.3%

    Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  53. 7.8CVE-2026-72993EPSS 0.3%

    Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  54. 7.8CVE-2026-72992EPSS 0.3%

    Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  55. 7.8CVE-2026-72991EPSS 0.3%

    Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  56. 7.8CVE-2026-72990EPSS 0.3%

    Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  57. 7.5CVE-2026-72989EPSS 1.0%

    Use of uninitialized resource in Windows Failover Cluster allows an unauthorized attacker to disclose information over a network.

  58. 7.8CVE-2026-72988EPSS 0.3%

    Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  59. 8.1CVE-2026-72987EPSS 0.7%

    Use after free in Windows DNS allows an unauthorized attacker to execute code over a network.

  60. 8.8CVE-2026-72986EPSS 0.8%

    Heap-based buffer overflow in Graphic Fonts allows an unauthorized attacker to execute code over a network.

  61. 6.8CVE-2026-72985EPSS 0.4%

    Heap-based buffer overflow in Windows Volume Shadow Copy allows an unauthorized attacker to elevate privileges with a physical attack.

  62. 9.8CVE-2026-72983EPSS 1.0%

    Use after free in Windows Internet Connection Sharing (ICS) allows an unauthorized attacker to execute code over a network.

  63. 9.8CVE-2026-72982EPSS 1.0%

    Stack-based buffer overflow in Windows Netlogon allows an unauthorized attacker to execute code over a network.

  64. 8.1CVE-2026-72981EPSS 0.7%

    Use after free in IP Helper allows an unauthorized attacker to execute code over a network.

  65. 5.5CVE-2026-72980EPSS 0.6%

    Uncontrolled search path element in Windows Hello allows an authorized attacker to bypass a security feature locally.

  66. 9.8CVE-2026-72979EPSS 1.0%

    Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network.

  67. 7.5CVE-2026-72978EPSS 1.0%

    Allocation of resources without limits or throttling in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.

  68. 6.5CVE-2026-72977EPSS 1.0%

    Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.

  69. 5.0CVE-2026-72976EPSS 0.5%

    Out-of-bounds read in Microsoft Office Word allows an authorized attacker to disclose information locally.

  70. 6.5CVE-2026-72975EPSS 0.9%

    Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.

  71. 6.5CVE-2026-72974EPSS 0.9%

    Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.

  72. 8.8CVE-2026-72973EPSS 0.8%

    Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

  73. 8.8CVE-2026-72972EPSS 0.8%

    Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

  74. 7.8CVE-2026-72967EPSS 0.3%

    Heap-based buffer overflow in Windows Network Connection Broker allows an authorized attacker to elevate privileges locally.

  75. 5.5CVE-2026-72966EPSS 0.3%

    Missing authorization in Windows Remote Access Connection Manager allows an authorized attacker to perform tampering locally.

  76. 7.8CVE-2026-72965EPSS 0.3%

    Use after free in Windows WebClient Service allows an authorized attacker to elevate privileges locally.

  77. 5.5CVE-2026-72964EPSS 0.3%

    Missing authentication for critical function in Windows Internet Connection Sharing (ICS) allows an authorized attacker to perform tampering locally.

  78. 7.0CVE-2026-72963EPSS 0.3%

    Use after free in Windows Modern Execution Server allows an authorized attacker to elevate privileges locally.

  79. 8.2CVE-2026-72962EPSS 0.3%

    Heap-based buffer overflow in Windows USB Video Driver allows an authorized attacker to elevate privileges locally.

  80. 8.2CVE-2026-72961EPSS 0.3%

    Out-of-bounds read in Windows Hyper-V allows an authorized attacker to elevate privileges locally.

  81. 8.8CVE-2026-72960EPSS 0.8%

    Heap-based buffer overflow in Windows Media Player allows an unauthorized attacker to execute code over a network.

  82. 8.8CVE-2026-72959EPSS 0.9%

    Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine

  83. 8.2CVE-2026-72958EPSS 0.3%

    Double free in Windows Credential Guard allows an authorized attacker to elevate privileges locally.

  84. 7.8CVE-2026-72957EPSS 0.3%

    Heap-based buffer overflow in Windows Deployment Services allows an authorized attacker to execute code locally.

  85. 6.5CVE-2026-72956EPSS 0.9%

    Untrusted pointer dereference in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.

  86. 7.5CVE-2026-72954EPSS 0.7%

    Use after free in Windows Deployment Services allows an authorized attacker to execute code over a network.

  87. 7.8CVE-2026-72953EPSS 0.3%

    Heap-based buffer overflow in Windows USB Driver allows an authorized attacker to elevate privileges locally.

  88. 7.0CVE-2026-72952EPSS 0.3%

    Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to execute code locally.

  89. 9.8CVE-2026-72950EPSS 0.9%

    Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine

  90. 7.5CVE-2026-72949EPSS 1.2%

    Null pointer dereference in Windows SMB Server Network Transport Driver (srvnet.sys) allows an unauthorized attacker to deny service over a network.

  91. 7.8CVE-2026-72948EPSS 0.4%

    Relative path traversal in Windows DNS allows an authorized attacker to elevate privileges locally.

  92. 7.0CVE-2026-72947EPSS 0.3%

    Integer underflow (wrap or wraparound) in Windows File History Service allows an authorized attacker to elevate privileges locally.

  93. 7.8CVE-2026-72946EPSS 0.3%

    Heap-based buffer overflow in Storage Port Driver allows an authorized attacker to elevate privileges locally.

  94. 5.5CVE-2026-72945EPSS 0.4%

    Use of uninitialized resource in Windows Task Scheduler allows an authorized attacker to disclose information locally.

  95. 7.8CVE-2026-72944EPSS 0.3%

    Heap-based buffer overflow in Windows Fax Service allows an authorized attacker to elevate privileges locally.

  96. 7.5CVE-2026-72943EPSS 0.7%

    Use after free in Windows Deployment Services allows an authorized attacker to execute code over a network.

  97. 6.5CVE-2026-72942EPSS 0.9%

    Out-of-bounds read in Windows Spaceport.sys allows an unauthorized attacker to disclose information over a network.

  98. 7.8CVE-2026-72941EPSS 0.3%

    Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  99. 8.8CVE-2026-72940EPSS 0.8%

    Heap-based buffer overflow in Windows Schannel allows an unauthorized attacker to execute code over a network.

  100. 6.5CVE-2026-72939EPSS 1.1%

    Null pointer dereference in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to deny service over a network.