Security

CVE detail from Microsoft's public MSRC CVRF API, cross-checked with CISA's Known Exploited Vulnerabilities catalog. Counts cover Microsoft-issued CVEs; republished third-party CVEs such as Chromium or Linux are hidden unless you include them.

Security Update Guide CISA KEV

998Microsoft CVEsreleased Tue 8 Sep 132Critical105 need an update · rest fixed service-side 2Exploited in the wild

0Publicly disclosed

2In CISA KEV

149Revised since release

Act first · September 2026

Exploited, KEV-listed, or publicly disclosed

CVE-2026-81963ImportantExploitedCISA KEV · due 22 Sep

Windows Update Stack Elevation of Privilege Vulnerability

Elevation of Privilege · CVSS 7.8 KB5122871 KB5122880 KB5124008+1

CVE-2026-85880ImportantExploitedCISA KEV · due 22 Sep

Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability

Elevation of Privilege · CVSS 7.8 KB5122876 KB5122878 KB5122882+3

Patch next · critical, "exploitation more likely", or top 5% EPSS · needs an update155

CVE-2026-69730CriticalExploitation More Likely

Windows DNS Server Remote Code Execution Vulnerability

Remote Code Execution · CVSS 9.8 · EPSS 1.0% KB5122871 KB5122876 KB5122882+3

CVE-2026-69676CriticalExploitation More Likely

Windows Kerberos Remote Code Execution Vulnerability

Remote Code Execution · CVSS 8.8 · EPSS 0.8% KB5122871 KB5122876 KB5122878+7

CVE-2026-69854CriticalExploitation More Likely

Spring Cloud Azure Elevation of Privilege Vulnerability

Elevation of Privilege · CVSS 9.0 · EPSS 0.7% No KB listed

CVE-2026-69852CriticalExploitation More Likely

Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability

Remote Code Execution · CVSS 7.5 · EPSS 0.7% KB5122871 KB5122876 KB5122878+7

CVE-2026-83501CriticalExploitation More Likely

Windows Virtualization-Based Security (VBS) Information Disclosure Vulnerability

Information Disclosure · CVSS 5.5 · EPSS 0.4% KB5122871 KB5122880 KB5124008+1

CVE-2026-72957CriticalExploitation More Likely

Windows Deployment Services Remote Code Execution Vulnerability

Remote Code Execution · CVSS 7.8 · EPSS 0.3% KB5122871 KB5122876 KB5122882+3

CVE-2026-70585CriticalExploitation More Likely

Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability

Remote Code Execution · CVSS 7.0 · EPSS 0.3% KB5122871 KB5122876 KB5122882+3

CVE-2026-65772CriticalExploitation Less Likely

Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability

Remote Code Execution · CVSS 8.8 · EPSS 1.7% No KB listed

Showing 8 of 155All critical

By impact

Elevation of Privilege 455

Remote Code Execution 260

Information Disclosure 177

Denial of Service 56

Security Feature Bypass 19

Spoofing 18

Tampering 13

By product family

Windows 727

ESU 650

Microsoft Office 139

SQL Server 62

Azure 24

Developer Tools 22

Server Software 9

Apps 5

CVEs · September 2026

139 matches · most urgent first CSV Text

CVE	Vulnerability	Severity	CVSS	EPSS	Impact	Status	Fixed by
CVE-2026-66302	Skype for Business Remote Code Execution VulnerabilitySkype for Business	Critical	9.8	1.0%	Remote Code Execution		KB5123287 KB5123300+1
CVE-2026-78509	Microsoft Office Outlook Remote Code Execution VulnerabilityMicrosoft Office Outlook	Critical	9.8	1.0%	Remote Code Execution	Revised 17 Sep	KB5002923
CVE-2026-69285	Microsoft Office Remote Code Execution VulnerabilityMicrosoft Office	Critical	8.8	0.8%	Remote Code Execution		KB5002916
CVE-2026-69632	Microsoft Office Remote Code Execution VulnerabilityMicrosoft Office	Critical	8.8	0.8%	Remote Code Execution	Revised 17 Sep	—
CVE-2026-69678	Microsoft Office PowerPoint Remote Code Execution VulnerabilityMicrosoft Office PowerPoint	Critical	8.8	0.8%	Remote Code Execution	Revised 17 Sep	KB5002920
CVE-2026-69767	Microsoft Office PowerPoint Remote Code Execution VulnerabilityMicrosoft Office PowerPoint	Critical	8.8	0.8%	Remote Code Execution	Revised 17 Sep	KB5002920
CVE-2026-69797	Microsoft Office PowerPoint Remote Code Execution VulnerabilityMicrosoft Office PowerPoint	Critical	8.8	0.8%	Remote Code Execution	Revised 17 Sep	KB5002920
CVE-2026-78439	Microsoft Office Graphics Component Remote Code Execution VulnerabilityMicrosoft Graphics Component	Critical	8.8	0.8%	Remote Code Execution	Revised 17 Sep	—
CVE-2026-78505	Microsoft Office Remote Code Execution VulnerabilityMicrosoft Office	Critical	8.8	0.8%	Remote Code Execution	Revised 17 Sep	KB5002916
CVE-2026-78519	Microsoft Office Outlook Remote Code Execution VulnerabilityMicrosoft Office Outlook	Critical	8.8	0.8%	Remote Code Execution		KB5002919
CVE-2026-78525	Microsoft Office Outlook Remote Code Execution VulnerabilityMicrosoft Office Outlook	Critical	8.8	0.8%	Remote Code Execution	Revised 17 Sep	KB5002923
CVE-2026-81952	Microsoft Word Remote Code Execution VulnerabilityMicrosoft Office Word	Critical	8.8	0.8%	Remote Code Execution	Revised 17 Sep	KB5002916
CVE-2026-81955	Windows Graphics Component Remote Code Execution VulnerabilityMicrosoft Graphics Component	Critical	8.8	0.8%	Remote Code Execution	Revised 17 Sep	KB5002916 KB5122871+9
CVE-2026-78510	Microsoft Outlook and Word Remote Code Execution VulnerabilityMicrosoft Office	Critical	8.4	0.3%	Remote Code Execution	Revised 25 Sep	KB5002916
CVE-2026-81948	Microsoft Excel Remote Code Execution VulnerabilityMicrosoft Office Excel	Critical	7.8	0.5%	Remote Code Execution	Revised 17 Sep	KB5002904 KB5002914
CVE-2026-81949	Microsoft Excel Remote Code Execution VulnerabilityMicrosoft Office Excel	Critical	7.8	0.5%	Remote Code Execution	Revised 17 Sep	KB5002904 KB5002914
CVE-2026-81950	Microsoft Excel Remote Code Execution VulnerabilityMicrosoft Office Excel	Critical	7.8	0.5%	Remote Code Execution	Revised 17 Sep	KB5002904 KB5002914
CVE-2026-81951	Microsoft Excel Remote Code Execution VulnerabilityMicrosoft Office Excel	Critical	7.8	0.5%	Remote Code Execution	Revised 24 Sep	KB5002904 KB5002914
CVE-2026-81953	Microsoft Excel Remote Code Execution VulnerabilityMicrosoft Office Excel	Critical	7.8	0.5%	Remote Code Execution	Revised 17 Sep	KB5002904 KB5002914
CVE-2026-81959	Microsoft Excel Remote Code Execution VulnerabilityMicrosoft Office Excel	Critical	7.8	0.5%	Remote Code Execution	Revised 17 Sep	KB5002904 KB5002914
CVE-2026-77898	Microsoft Office Remote Code Execution VulnerabilityMicrosoft Office	Critical	7.5	0.6%	Remote Code Execution	Revised 17 Sep	—
CVE-2026-78520	Microsoft Office Outlook Information Disclosure VulnerabilityMicrosoft Office Outlook	Critical	6.5	0.9%	Remote Code Execution	Revised 17 Sep	KB5002923
CVE-2026-69268	Microsoft Office SharePoint Remote Code Execution VulnerabilityMicrosoft Office SharePoint	Important	8.8	0.8%	Remote Code Execution		KB5002908
CVE-2026-69273	Microsoft Office SharePoint Remote Code Execution VulnerabilityMicrosoft Office SharePoint	Important	8.8	0.8%	Remote Code Execution		KB5002908
CVE-2026-69282	Microsoft Office SharePoint Remote Code Execution VulnerabilityMicrosoft Office SharePoint	Important	8.8	0.8%	Remote Code Execution	Revised 24 Sep	KB5002908
CVE-2026-69442	Microsoft Office Remote Code Execution VulnerabilityMicrosoft Office	Important	8.8	0.8%	Remote Code Execution		KB5002916
CVE-2026-69464	Microsoft Office SharePoint Elevation of Privilege VulnerabilityMicrosoft Office SharePoint	Important	8.8	0.9%	Elevation of Privilege		KB5002908
CVE-2026-69465	Microsoft Office SharePoint Remote Code Execution VulnerabilityMicrosoft Office SharePoint	Important	8.8	0.8%	Remote Code Execution		KB5002908
CVE-2026-69529	Microsoft Office Access Remote Code Execution VulnerabilityMicrosoft Office Access	Important	8.8	0.8%	Remote Code Execution		KB5002913
CVE-2026-69556	Microsoft Office Word Remote Code Execution VulnerabilityMicrosoft Office Word	Important	8.8	0.8%	Remote Code Execution		KB5002923
CVE-2026-69614	Microsoft Office Access Remote Code Execution VulnerabilityMicrosoft Office Access	Important	8.8	0.9%	Remote Code Execution		KB5002912
CVE-2026-69629	Microsoft Office Outlook Remote Code Execution VulnerabilityMicrosoft Office Outlook	Important	8.8	0.8%	Remote Code Execution		KB5002919
CVE-2026-69671	Microsoft Office Word Remote Code Execution VulnerabilityMicrosoft Office Word	Important	8.8	0.8%	Remote Code Execution	Revised 17 Sep	KB5002923
CVE-2026-69686	Microsoft Office Word Remote Code Execution VulnerabilityMicrosoft Office Word	Important	8.8	0.8%	Remote Code Execution	Revised 17 Sep	KB5002923
CVE-2026-69716	Microsoft Office SharePoint Elevation of Privilege VulnerabilityMicrosoft Office SharePoint	Important	8.8	1.0%	Elevation of Privilege		KB5002908
CVE-2026-69722	Microsoft Office Word Remote Code Execution VulnerabilityMicrosoft Office Word	Important	8.8	0.8%	Remote Code Execution	Revised 17 Sep	KB5002923
CVE-2026-69724	Microsoft Office SharePoint Remote Code Execution VulnerabilityMicrosoft Office SharePoint	Important	8.8	0.8%	Remote Code Execution	Revised 17 Sep	KB5002908
CVE-2026-69742	Microsoft Office Publisher Remote Code Execution VulnerabilityMicrosoft Office Publisher	Important	8.8	0.8%	Remote Code Execution		KB5002644
CVE-2026-69759	Microsoft Office Word Remote Code Execution VulnerabilityMicrosoft Office Word	Important	8.8	0.8%	Remote Code Execution	Revised 17 Sep	KB5002923
CVE-2026-69764	Microsoft Office Word Remote Code Execution VulnerabilityMicrosoft Office Word	Important	8.8	0.8%	Remote Code Execution		KB5002916 KB5002923
CVE-2026-69778	Microsoft Office Access Remote Code Execution VulnerabilityMicrosoft Office Access	Important	8.8	0.8%	Remote Code Execution		KB5002913
CVE-2026-70125	Microsoft Office Outlook Remote Code Execution VulnerabilityMicrosoft Office Outlook	Important	8.8	0.4%	Remote Code Execution		—
CVE-2026-72972	Microsoft Office Word Remote Code Execution VulnerabilityMicrosoft Office Word	Important	8.8	0.8%	Remote Code Execution	Revised 17 Sep	KB5002923
CVE-2026-72973	Microsoft Office Word Remote Code Execution VulnerabilityMicrosoft Office Word	Important	8.8	0.8%	Remote Code Execution	Revised 17 Sep	KB5002923
CVE-2026-77901	Microsoft Office Word Remote Code Execution VulnerabilityMicrosoft Office Word	Important	8.8	0.8%	Remote Code Execution	Revised 21 Sep	KB5002923
CVE-2026-78504	Microsoft Office Word Remote Code Execution VulnerabilityMicrosoft Office Word	Important	8.8	0.8%	Remote Code Execution	Revised 17 Sep	KB5002923
CVE-2026-78507	Microsoft Office Word Remote Code Execution VulnerabilityMicrosoft Office Word	Important	8.8	0.8%	Remote Code Execution	Revised 17 Sep	—
CVE-2026-78511	Microsoft Office Word Remote Code Execution VulnerabilityMicrosoft Office Word	Important	8.8	0.8%	Remote Code Execution	Revised 17 Sep	KB5002923
CVE-2026-78512	Microsoft Office Word Remote Code Execution VulnerabilityMicrosoft Office Word	Important	8.8	0.8%	Remote Code Execution	Revised 17 Sep	KB4011160
CVE-2026-78514	Microsoft Office Word Remote Code Execution VulnerabilityMicrosoft Office Word	Important	8.8	0.8%	Remote Code Execution	Revised 17 Sep	KB5002923

CISA KEV · Microsoft additions

389 Microsoft CVEs listed

CVE-2026-65660 SharePoint

Microsoft SharePoint Code Injection Vulnerability

Added 25 Sep 2026Federal due date 28 Sep

CVE-2026-85880 Windows

Microsoft Windows Heap-Based Buffer Overflow Vulnerability

Added 8 Sep 2026Federal due date 22 Sep

CVE-2026-81963 Windows

Microsoft Windows Link Following Vulnerability

Added 8 Sep 2026Federal due date 22 Sep

CVE-2019-1068 SQL Server

Microsoft SQL Server Remote Code Execution Vulnerability

Added 26 Aug 2026Federal due date 29 Aug

CVE-2026-55040 SharePoint

Microsoft SharePoint Weak Authentication Vulnerability

Added 18 Aug 2026Federal due date 21 Aug

CVE-2026-33824 Internet Key Exchange (IKE) Service Extensions

Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability

Added 18 Aug 2026Federal due date 21 Aug

CVE-2026-68820 Windows Ancillary Function Driver for WinSock

Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability

Added 11 Aug 2026Federal due date 25 Aug

CVE-2026-50522 SharePoint

Microsoft SharePoint Deserialization of Untrusted Data Vulnerability

Added 22 Jul 2026Federal due date 25 Jul

CVE-2026-58644 SharePoint

Microsoft SharePoint Deserialization of Untrusted Data Vulnerability

Added 16 Jul 2026Federal due date 19 Jul

CVE-2026-56164 SharePoint Server

Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability

Added 14 Jul 2026Federal due date 17 Jul

CVE-2026-56155 Active Directory Federation Services

Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability

Added 14 Jul 2026Federal due date 28 Jul

CVE-2026-45659 SharePoint ServerRansomware

Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability

Added 1 Jul 2026Federal due date 4 Jul

Security news

All

Fri 25 Sep1 item

Storm-3168: Agentic-driven cloud attacks using compromised service principals

Security Microsoft Security Blog

2d ago

Thu 24 Sep2 items

Beyond the ransomware: Tracking Storm-2570’s consistent tradecraft across deployments

Security Microsoft Security Blog

3d ago

What’s new in Microsoft Security: September 2026

Security Microsoft Security Blog

3d ago

Wed 23 Sep3 items

Integrated Security Operations Center in Microsoft Defender

Microsoft 365 Microsoft Defender XDR Blog

4d ago

Reimagining the SOC for the agentic era in Microsoft Defender

Security Microsoft Security Blog

4d ago

Reimagining Case Management in Microsoft Defender

Microsoft 365 Microsoft Defender XDR Blog

4d ago

Tue 22 Sep1 item

Unmasking EvilTokens: Getting to the root of device code phishing

Security Microsoft Security Blog

5d ago

Thu 17 Sep2 items

From guidance to action: Security fundamentals that materially reduce risk

Security Microsoft Security Blog

10d ago

Improving email security outcomes with real-world Microsoft Defender insights

Security Microsoft Security Blog

10d ago

Tue 15 Sep1 item

From DLP Alert Volume to Measurable Detection Assurance

Security Microsoft Security Community Blog

12d ago

Mon 14 Sep1 item

Public Preview: Multi-account support for Microsoft Sentinel codeless connectors

Azure Microsoft Sentinel Blog

13d ago

Thu 10 Sep1 item

Protecting organizations from AI-assisted executive impersonation and invoice fraud

Security Microsoft Security Blog

17d ago