Security September 2026 CVE-2026-96442
Severity Important
CVSS base score 7.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Impact Not stated
EPSS · 30-day forecast No EPSS score collected
Public detection template No Nuclei template is listed in the current collected catalog
Exploitation detected Unknown: not stated by MSRC
Exploitability Not assessed
Publicly disclosed Unknown: not stated by MSRC
Customer action Required: follow the MSRC remediation guidance
Component Mariner
Weakness CWE-94: Improper Control of Generation of Code ('Code Injection')
Issued by redhat
Last revised 13 Oct 2026Information published. CVSS 3.1 base metrics Red raises the risk · green lowers it
Attack vector LocalAV:L
Attack complexity LowAC:L
Privileges required NonePR:N
User interaction RequiredUI:R
Scope UnchangedS:U
Confidentiality HighC:H
Integrity HighI:H
Availability HighA:H
0 KBs No KB listed No KB update is listed in the collected MSRC record. Check the MSRC advisory for product releases and other remedies.
Open Source Software
1 affected product
azl3 emacs 29.4-6 on Azure Linux 3.0 Source. This summary comes from MSRC's public CVRF document for September 2026. If the MSRC page is blocked in your browser, the NVD and CVE.org records carry the same identifier. None of this says whether your devices are affected.
Detection template: No Nuclei template listed · Customer action: Required: apply the update → Required: follow the MSRC remediation guidance · Public disclosure: No → Unknown: not stated by MSRC · Exploitation detected: Not reported by MSRC → Unknown: not stated by MSRC
29 Oct 2026 Detection template: Unknown: exploit-code evidence is incomplete or retained → No Nuclei template listed · CISA KEV: Unknown: catalog evidence is incomplete or retained → Not listed in the collected catalog
23 Oct 2026 · 09:33:49 UTC Detection template: No Nuclei template listed → Unknown: exploit-code evidence is incomplete or retained · CISA KEV: Not listed in the collected catalog → Unknown: catalog evidence is incomplete or retained
23 Oct 2026 · 08:31:50 UTC
Changes are dated when recorded; day views use the last saved version from that UTC day, and citations stay fixed.
Cite this version Field-level log (19)
Up to 100 recent field edits are shown; older edits may be outside retention.
29 Oct 2026 · 20:19:26 UTC
Public detection template No Nuclei template listed 29 Oct 2026 · 20:19:26 UTC
EPSS Not scored → No EPSS score collected 29 Oct 2026 · 20:19:26 UTC
Customer action Required: apply the update → Required: follow the MSRC remediation guidance 29 Oct 2026 · 20:19:26 UTC
Publicly disclosed No → Unknown: not stated by MSRC 29 Oct 2026 · 20:19:26 UTC
Exploitation detected Not reported by MSRC → Unknown: not stated by MSRC 23 Oct 2026 · 09:33:49 UTC
Public exploit code Unknown: exploit-code evidence is incomplete or retained → No Nuclei template listed 23 Oct 2026 · 09:33:49 UTC
CISA KEV Unknown: catalog evidence is incomplete or retained → Not listed in the collected catalog 23 Oct 2026 · 09:33:49 UTC
Source coverage: public-exploit-code Incomplete → Current 23 Oct 2026 · 09:33:49 UTC
Source coverage: first-epss Incomplete → Current 23 Oct 2026 · 09:33:49 UTC
Source coverage: cisa-kev Incomplete → Current 23 Oct 2026 · 09:33:49 UTC
Source coverage: msrc-cvrf Incomplete → Current 23 Oct 2026 · 08:31:50 UTC
Public exploit code No Nuclei template listed → Unknown: exploit-code evidence is incomplete or retained 23 Oct 2026 · 08:31:50 UTC
CISA KEV Not listed in the collected catalog → Unknown: catalog evidence is incomplete or retained 23 Oct 2026 · 08:31:50 UTC
Source coverage: public-exploit-code Current → Incomplete 23 Oct 2026 · 08:31:50 UTC
Source coverage: first-epss Current → Incomplete 23 Oct 2026 · 08:31:50 UTC
Source coverage: cisa-kev Current → Incomplete 23 Oct 2026 · 08:31:50 UTC
Source coverage: msrc-cvrf Current → Incomplete 18 Oct 2026 · 14:54:30 UTC
Link: September 2026 /security?release=2026-Sep#cves 14 Oct 2026 · 11:22:42 UTC
Source coverage: msrc-cvrf Incomplete → Current Explore global source statements, affected packages and advisory history for CVE-2026-96442 . The catalog has a separate collection scope from Microsoft release records.
cve-program · CVE-2026-96442 Published emacs https://git.savannah.gnu.org/cgit/emacs.git/
Original vendor version evidence · not evaluated as a NuGet range {
"vendor": "GNU Emacs",
"product": "GNU Emacs",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "31.2",
"versionType": "semver"
}
],
"packageName": "emacs",
"collectionURL": "https://git.savannah.gnu.org/cgit/emacs.git/",
"defaultStatus": "unaffected"
} emacs https://access.redhat.com/downloads/content/package-browser/
Original vendor version evidence · not evaluated as a NuGet range {
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "emacs",
"defaultStatus": "affected",
"versions": [
{
"version": "1:29.4-14.el10_2.3",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
]
} emacs https://access.redhat.com/downloads/content/package-browser/
Original vendor version evidence · not evaluated as a NuGet range {
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "emacs",
"defaultStatus": "affected",
"versions": [
{
"version": "1:26.1-15.el8_10.4",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:8::appstream",
"cpe:/o:redhat:enterprise_linux:8::baseos"
]
} emacs https://access.redhat.com/downloads/content/package-browser/
Original vendor version evidence · not evaluated as a NuGet range {
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "emacs",
"defaultStatus": "affected",
"versions": [
{
"version": "1:26.1-15.el8_10.4",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:8::appstream",
"cpe:/o:redhat:enterprise_linux:8::baseos"
]
} emacs https://access.redhat.com/downloads/content/package-browser/
Original vendor version evidence · not evaluated as a NuGet range {
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "emacs",
"defaultStatus": "affected",
"versions": [
{
"version": "1:27.2-18.el9_8.3",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream"
]
} emacs https://access.redhat.com/downloads/content/package-browser/
Original vendor version evidence · not evaluated as a NuGet range {
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 6",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "emacs",
"defaultStatus": "unknown",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
]
} emacs https://access.redhat.com/downloads/content/package-browser/
Original vendor version evidence · not evaluated as a NuGet range {
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 7",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "emacs",
"defaultStatus": "affected",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
]
} Original source record · Cite this exact observation · Complete original publisher JSON