Security
CVE detail from Microsoft's public MSRC CVRF API, cross-checked with CISA's Known Exploited Vulnerabilities catalog. Counts cover Microsoft-issued CVEs; republished third-party CVEs such as Chromium or Linux are hidden unless you include them.
Fixed by KB5128898Clear
| CVE | Vulnerability | Severity | CVSS | Impact | Status | Fixed by |
|---|---|---|---|---|---|---|
| CVE-2026-70571 | Microsoft Exchange Server Remote Code Execution VulnerabilityMicrosoft Exchange Server | Critical | 8.1 | RCENetwork | KB5128895KB5128896+2 | |
| CVE-2026-70279 | Microsoft Exchange Server Spoofing VulnerabilityMicrosoft Exchange Server | Important | 9.3 | SpoofingNetwork | KB5128895KB5128896+2 | |
| CVE-2026-77910 | Microsoft Exchange Server Elevation of Privilege VulnerabilityMicrosoft Exchange Server | Important | 8.8 | EoPNetwork | KB5128895KB5128896+2 | |
| CVE-2026-87692 | Microsoft Exchange Server Elevation of Privilege VulnerabilityMicrosoft Exchange Server | Important | 7.8 | EoPLocal | KB5128895KB5128897+1 | |
| CVE-2026-87695 | Microsoft Exchange Server Elevation of Privilege VulnerabilityMicrosoft Exchange Server | Important | 7.8 | EoPLocal | KB5128895KB5128896+2 | |
| CVE-2026-87696 | Microsoft Exchange Server Elevation of Privilege VulnerabilityMicrosoft Exchange Server | Important | 7.5 | EoPNetwork | KB5128895KB5128896+2 |
Advisories
MSRC guidance without a CVE of its own · 1 advisory
Hardening changes for ReFS volumes on removable mediaStarting with Windows updates released on and after October 13, 2026, Microsoft is making hardening changes to the Resilient File System (ReFS) . This change is not enable by default until 2027. Please see Hardening changes for ReFS volumes on removable media for more information.