cve.bz

Microsoft Patch Tuesday, September 2026: the CVEs, page 6

Filter

Microsoft Patch Tuesday September 2026: the CVEs Microsoft published on 8 September 2026, the second Tuesday of the month, with CVSS, EPSS, CISA KEV and public exploits to show what to patch first. Narrow it: in CISA KEV · critical. The same day: Adobe, SAP. Earlier: Aug 2026, Jul 2026, Jun 2026, May 2026, Apr 2026, Mar 2026, Feb 2026, Jan 2026, Dec 2025, Nov 2025, Oct 2025, Sep 2025. Other lists: CISA KEV list, CVE exploit search, Latest critical CVEs, Ransomware CVEs, New CVEs today, This week, Patch Tuesday

  1. 5.5CVE-2026-69684EPSS 0.5%

    Generation of error message containing sensitive information in Windows Error Reporting allows an authorized attacker to disclose information locally.

  2. 7.7CVE-2026-69683EPSS 0.8%

    Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.

  3. 7.0CVE-2026-69682EPSS 0.2%

    Use after free in Windows Host Guardian Service allows an authorized attacker to elevate privileges locally.

  4. 8.8CVE-2026-69681EPSS 0.8%

    Heap-based buffer overflow in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges over a network.

  5. 8.1CVE-2026-69680EPSS 0.3%

    Origin validation error in Windows DNS allows an unauthorized attacker to perform spoofing over a network.

  6. 5.7CVE-2026-69679EPSS 0.6%

    Out-of-bounds read in Windows DHCP Server allows an authorized attacker to deny service over an adjacent network.

  7. 8.8CVE-2026-69678EPSS 0.8%

    Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.

  8. 8.8CVE-2026-69676EPSS 0.8%

    Authentication bypass by capture-replay in Windows Kerberos allows an authorized attacker to execute code over a network.

  9. 5.5CVE-2026-69674EPSS 0.3%

    Missing authentication for critical function in Windows Modern Device Management (MDM) allows an authorized attacker to bypass a security feature locally.

  10. 5.5CVE-2026-69672EPSS 0.4%

    Use of uninitialized resource in Windows DNS allows an authorized attacker to disclose information locally.

  11. 8.8CVE-2026-69671EPSS 0.8%

    Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

  12. 8.8CVE-2026-69669EPSS 0.8%

    Heap-based buffer overflow in Windows Kernel allows an unauthorized attacker to execute code over a network.

  13. 7.0CVE-2026-69654EPSS 0.3%

    Use after free in Windows Accounts Control allows an authorized attacker to elevate privileges locally.

  14. 7.0CVE-2026-69652EPSS 0.3%

    Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.

  15. 8.8CVE-2026-69649EPSS 0.8%

    Heap-based buffer overflow in Windows Raw Image Extension allows an unauthorized attacker to execute code over a network.

  16. 7.0CVE-2026-69648EPSS 0.3%

    Use after free in Windows Notification allows an authorized attacker to elevate privileges locally.

  17. 7.0CVE-2026-69645EPSS 0.3%

    Use after free in Windows Message Queuing allows an authorized attacker to elevate privileges locally.

  18. 8.0CVE-2026-69643EPSS 0.8%

    Heap-based buffer overflow in Windows Spaceport.sys allows an authorized attacker to elevate privileges over a network.

  19. 9.1CVE-2026-69641EPSS 0.9%

    Missing authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

  20. 8.4CVE-2026-69638EPSS 0.4%

    Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally.

  21. 5.7CVE-2026-69637EPSS 0.6%

    Out-of-bounds read in Windows DHCP Server allows an authorized attacker to deny service over an adjacent network.

  22. 6.5CVE-2026-69636EPSS 1.0%

    Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.

  23. 8.8CVE-2026-69632EPSS 0.8%

    Use after free in Microsoft Office allows an unauthorized attacker to execute code over a network.

  24. 7.5CVE-2026-69631EPSS 1.2%

    Integer overflow or wraparound in Windows DNS allows an unauthorized attacker to deny service over a network.

  25. 7.0CVE-2026-69630EPSS 0.3%

    Out-of-bounds read in Windows Win32K allows an authorized attacker to elevate privileges locally.

  26. 8.8CVE-2026-69629EPSS 0.8%

    Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.

  27. 8.8CVE-2026-69628EPSS 0.9%

    Heap-based buffer overflow in Windows iSCSI allows an authorized attacker to execute code over a network.

  28. 5.5CVE-2026-69627EPSS 0.4%

    Out-of-bounds read in Windows Remote Desktop Licensing Service allows an authorized attacker to disclose information locally.

  29. 6.5CVE-2026-69626EPSS 0.9%

    Buffer over-read in Microsoft Office allows an unauthorized attacker to disclose information over a network.

  30. 8.8CVE-2026-69625EPSS 0.8%

    Heap-based buffer overflow in Windows Connected User Experiences and Telemetry allows an authorized attacker to elevate privileges over a network.

  31. 6.5CVE-2026-69624EPSS 0.7%

    Incomplete list of disallowed inputs in Active Directory Certificate Services (AD CS) allows an authorized attacker to perform tampering over a network.

  32. 8.0CVE-2026-69623EPSS 0.8%

    Heap-based buffer overflow in Windows HTTP Print Provider allows an authorized attacker to execute code over a network.

  33. 7.0CVE-2026-69621EPSS 0.3%

    Heap-based buffer overflow in Windows Fax Service allows an authorized attacker to elevate privileges locally.

  34. 8.1CVE-2026-69620EPSS 0.7%

    Stack-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over a network.

  35. 8.8CVE-2026-69619EPSS 0.8%

    Out-of-bounds read in Windows exFAT File System allows an authorized attacker to elevate privileges over a network.

  36. 5.5CVE-2026-69618EPSS 0.4%

    Out-of-bounds read in Windows SMB Client allows an authorized attacker to disclose information locally.

  37. 7.0CVE-2026-69617EPSS 0.3%

    Out-of-bounds read in Windows Resilient File System (ReFS) allows an authorized attacker to elevate privileges locally.

  38. 5.5CVE-2026-69616EPSS 0.4%

    Out-of-bounds read in Windows Remote Desktop Services allows an authorized attacker to disclose information locally.

  39. 4.8CVE-2026-69615EPSS 0.4%

    Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

  40. 8.8CVE-2026-69614EPSS 0.9%

    Stack-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.

  41. 7.0CVE-2026-69613EPSS 0.3%

    Use after free in Windows Image Acquisition allows an authorized attacker to elevate privileges locally.

  42. 7.8CVE-2026-69612EPSS 0.4%

    Absolute path traversal in Windows Error Reporting allows an authorized attacker to elevate privileges locally.

  43. 7.0CVE-2026-69611EPSS 0.3%

    Use after free in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally.

  44. 7.0CVE-2026-69610EPSS 0.3%

    Buffer over-read in Windows Win32K allows an authorized attacker to elevate privileges locally.

  45. 5.5CVE-2026-69609EPSS 0.4%

    Out-of-bounds read in Windows Win32K allows an authorized attacker to disclose information locally.

  46. 7.8CVE-2026-69608EPSS 0.3%

    Integer overflow or wraparound in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.

  47. 7.5CVE-2026-69607EPSS 0.6%

    Use after free in Windows Deployment Services allows an unauthorized attacker to execute code over a network.

  48. 7.0CVE-2026-69606EPSS 0.3%

    Use after free in Windows Shell allows an authorized attacker to elevate privileges locally.

  49. 7.0CVE-2026-69605EPSS 0.3%

    Use after free in Microsoft Install Service allows an authorized attacker to elevate privileges locally.

  50. 7.8CVE-2026-69604EPSS 0.3%

    Heap-based buffer overflow in Windows Audio Service allows an authorized attacker to elevate privileges locally.

  51. 8.8CVE-2026-69603EPSS 0.3%

    Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to execute code locally.

  52. 7.5CVE-2026-69602EPSS 0.6%

    Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges over a network.

  53. 8.8CVE-2026-69601EPSS 0.8%

    Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.

  54. 7.0CVE-2026-69600EPSS 0.3%

    Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.

  55. 7.5CVE-2026-69599EPSS 0.7%

    Use after free in Windows Remote Desktop Services allows an authorized attacker to execute code over a network.

  56. 8.8CVE-2026-69598EPSS 0.8%

    Incorrect calculation of buffer size in Windows iSCSI allows an unauthorized attacker to execute code over a network.

  57. 7.5CVE-2026-69597EPSS 0.6%

    Use after free in Windows HTTP.sys allows an authorized attacker to elevate privileges over a network.

  58. 9.8CVE-2026-69595EPSS 1.0%

    Use after free in Windows Services for NFS ONCRPC XDR Driver allows an unauthorized attacker to execute code over a network.

  59. 7.8CVE-2026-69594EPSS 0.3%

    Heap-based buffer overflow in Microsoft Local Security Authority Server (lsasrv) allows an authorized attacker to elevate privileges locally.

  60. 7.8CVE-2026-69593EPSS 0.3%

    Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  61. 7.8CVE-2026-69592EPSS 0.3%

    Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.

  62. 5.7CVE-2026-69591EPSS 0.9%

    Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose information over a network.

  63. 9.8CVE-2026-69590EPSS 1.0%

    Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine

  64. 7.8CVE-2026-69589EPSS 0.3%

    Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  65. 7.5CVE-2026-69588EPSS 1.2%

    Missing release of memory after effective lifetime in Windows TCP/IP allows an unauthorized attacker to deny service over a network.

  66. 7.5CVE-2026-69587EPSS 1.2%

    Null pointer dereference in Windows IKE Extension allows an unauthorized attacker to deny service over a network.

  67. 9.8CVE-2026-69586EPSS 1.0%

    Integer overflow or wraparound in Microsoft Windows PDF allows an unauthorized attacker to execute code over a network.

  68. 7.8CVE-2026-69585EPSS 0.3%

    Incorrect type conversion or cast in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.

  69. 7.8CVE-2026-69584EPSS 0.3%

    Integer overflow or wraparound in Windows USB Video Driver allows an authorized attacker to elevate privileges locally.

  70. 7.8CVE-2026-69583EPSS 0.3%

    Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  71. 7.8CVE-2026-69582EPSS 0.3%

    Buffer over-read in Windows Volume Manager Extension Driver allows an authorized attacker to elevate privileges locally.

  72. 7.0CVE-2026-69581EPSS 0.2%

    Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally.

  73. 7.8CVE-2026-69580EPSS 0.3%

    Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  74. 9.8CVE-2026-69579EPSS 1.0%

    Use after free in Windows Message Queuing allows an unauthorized attacker to execute code over a network.

  75. 7.0CVE-2026-69578EPSS 0.3%

    Numeric truncation error in Windows Kernel allows an authorized attacker to elevate privileges locally.

  76. 7.8CVE-2026-69576EPSS 0.3%

    Use after free in Graphic Fonts allows an authorized attacker to elevate privileges locally.

  77. 7.0CVE-2026-69575EPSS 0.3%

    Use after free in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally.

  78. 7.0CVE-2026-69574EPSS 0.3%

    Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally.

  79. 7.0CVE-2026-69573EPSS 0.3%

    Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.

  80. 5.7CVE-2026-69572EPSS 0.9%

    Out-of-bounds read in Windows SMB Client allows an authorized attacker to disclose information over a network.

  81. 7.8CVE-2026-69571EPSS 0.3%

    Heap-based buffer overflow in Windows USB Audio Class driver (usbaudio.sys) allows an authorized attacker to elevate privileges locally.

  82. 5.7CVE-2026-69569EPSS 0.9%

    Untrusted pointer dereference in Windows Print Spooler Components allows an authorized attacker to deny service over a network.

  83. 5.5CVE-2026-69568EPSS 0.4%

    Out-of-bounds read in Windows Storage Spaces Controller allows an authorized attacker to disclose information locally.

  84. 7.0CVE-2026-69567EPSS 0.3%

    Use after free in Windows NTFS allows an authorized attacker to elevate privileges locally.

  85. 6.8CVE-2026-69566EPSS 0.4%

    Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code with a physical attack.

  86. 7.0CVE-2026-69564EPSS 0.3%

    Heap-based buffer overflow in Windows Online Certificate Status Protocol (OCSP) allows an authorized attacker to elevate privileges locally.

  87. 7.0CVE-2026-69563EPSS 0.2%

    Heap-based buffer overflow in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.

  88. 6.5CVE-2026-69562EPSS 0.9%

    Out-of-bounds read in SQL Server allows an unauthorized attacker to disclose information over a network.

  89. 7.8CVE-2026-69561EPSS 0.3%

    Out-of-bounds read in Windows CD-ROM Driver allows an authorized attacker to elevate privileges locally.

  90. 7.0CVE-2026-69560EPSS 0.3%

    Use after free in Windows Work Folder Service allows an authorized attacker to elevate privileges locally.

  91. 6.3CVE-2026-69559EPSS 0.3%

    Origin validation error in Microsoft Teams for Android allows an authorized attacker to disclose information over a network.

  92. 8.8CVE-2026-69556EPSS 0.8%

    Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

  93. 5.5CVE-2026-69554EPSS 0.3%

    Missing authentication for critical function in Microsoft Windows Search Component allows an authorized attacker to perform tampering locally.

  94. 7.5CVE-2026-69553EPSS 0.5%

    Missing authorization in Windows Hyper-V allows an authorized attacker to elevate privileges over a network.

  95. 5.7CVE-2026-69552EPSS 0.9%

    Generation of error message containing sensitive information in Windows Print Spooler Components allows an authorized attacker to disclose information over a network.

  96. 8.8CVE-2026-69551EPSS 0.9%

    Use after free in Windows DNS allows an authorized attacker to execute code over a network.

  97. 7.0CVE-2026-69549EPSS 0.3%

    Out-of-bounds read in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally.

  98. 4.6CVE-2026-69548EPSS 0.5%

    Heap-based buffer overflow in Windows RNDIS allows an unauthorized attacker to disclose information with a physical attack.

  99. 8.8CVE-2026-69547EPSS 0.9%

    Heap-based buffer overflow in Windows DHCP Server allows an authorized attacker to execute code over a network.

  100. 8.1CVE-2026-69546EPSS 0.7%

    Use after free in Active Directory Domain Services allows an unauthorized attacker to execute code over a network.