122/122 sources · synced 20:24 UTC Customize Public mode

Security

CVE detail from Microsoft's public MSRC CVRF API, cross-checked with CISA's Known Exploited Vulnerabilities catalog. Counts cover Microsoft-issued CVEs; republished third-party CVEs such as Chromium or Linux are hidden unless you include them.

Security Update Guide CISA KEV
1Microsoft CVEsreleased Fri 2 Oct 0Critical0 need an update · rest fixed service-side 0Exploited in the wild
0Publicly disclosed
0In CISA KEV
0Revised since release

Act first · October 2026

Exploited, KEV-listed, or publicly disclosed

No exploited or disclosed CVEs

Microsoft reports no exploitation or public disclosure for this release. Prioritize by severity below.

Patch next · critical, "exploitation more likely", or top 5% EPSS · needs an update1
Elevation of Privilege · CVSS 8.8 KB5129955KB5129956KB5129957+1

CVEs · October 2026

1 match · most urgent first CSV Text
CVE Vulnerability Severity CVSSImpact StatusFixed by
CVE-2026-96940 Microsoft Exchange Server Elevation of Privilege VulnerabilityMicrosoft Exchange Server Important 8.8Elevation of Privilege
KB5129955KB5129956+2

CISA KEV · Microsoft additions

All 389
CVE-2026-65660 SharePoint
Microsoft SharePoint Code Injection Vulnerability
Added 25 Sep 2026Federal due date 28 Sep
CVE-2026-85880 Windows
Microsoft Windows Heap-Based Buffer Overflow Vulnerability
Added 8 Sep 2026Federal due date 22 Sep
CVE-2026-81963 Windows
Microsoft Windows Link Following Vulnerability
Added 8 Sep 2026Federal due date 22 Sep
CVE-2019-1068 SQL Server
Microsoft SQL Server Remote Code Execution Vulnerability
Added 26 Aug 2026Federal due date 29 Aug

Security news

All
Yesterday2 items
Wed 30 Sep2 items

Exploited in other vendors' products

CISA KEV · Apple, Android, Chrome, Firefox, VMware, Oracle, Jamf · last 90 days
CVE-2026-86950 Apple · Multiple Products
Apple Multiple Products Out-of-Bounds Write Vulnerability
Added 29 Sep 2026iOS and iPadOSmacOS
CVE-2026-58704 Google · Pixel
Google Pixel Improper Authorization Vulnerability
Added 16 Sep 2026Android
CVE-2026-87491 Google · Chromium V8
Google Chromium V8 Out of Bounds Write Vulnerability
Added 9 Sep 2026Google Chrome
CVE-2026-85046 Google · Chromium V8
Google Chromium V8 Type Confusion Vulnerability
Added 4 Sep 2026Google Chrome
CVE-2026-21962 Oracle · HTTP Server and Oracle Weblogic Server Proxy Plug-in
Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability
Added 24 Aug 2026Oracle WebLogic Server
CVE-2026-65400 Apple · macOS
Apple macOS Improper Authentication Vulnerability
Added 18 Aug 2026macOS
CVE-2026-59310 Broadcom · VMware vCenterRansomware
Broadcom VMware vCenter Path Traversal Vulnerability
Added 18 Aug 2026VMware vCenter Server
CVE-2026-46817 Oracle · E-Business Suite
Oracle E-Business Suite Improper Privilege Management Vulnerability
Added 15 Jul 2026Oracle E-Business Suite

Security baselines

Microsoft Security Compliance Toolkit downloads, as the download page lists them
  • 1.0LGPO.zip
    Microsoft Security Compliance Toolkit artifacts · · 519 KB

    Revised 29 Sep 2026: the text changed

  • 1.0Microsoft 365 Apps for Enterprise 2512.zip
    Microsoft Security Compliance Toolkit artifacts · · 871 KB

    Revised 29 Sep 2026: the text changed

  • 1.0Microsoft Edge v151 Security Baseline.zip
    Microsoft Security Compliance Toolkit artifacts · · 455 KB

    Revised 29 Sep 2026: the text changed

  • 1.0PolicyAnalyzer.zip
    Microsoft Security Compliance Toolkit artifacts · · 1.5 MB

    Revised 29 Sep 2026: the text changed

11 more open

Sizes and dates are what Microsoft's download page reports; ChangeIntel does not download or check the files.

ChangeIntel

An IT change radar: releases, security, known issues, retirements, and service status from 122 public sources. Every item links to its original page; dates and statuses can change after they are read.

Sources read 2 Oct 20:24 UTC · 122 of 122 readable

No accounts or analytics; your preferences stay in your browser. Information, not advice. ChangeIntel is an independent tool and is not affiliated with or endorsed by Microsoft, Apple, Google, Broadcom (VMware), Jamf, Oracle, Mozilla, or any other vendor it covers. Product names are trademarks of their owners. Built by Evotec.