Microsoft Windows 11 26h1 vulnerabilities

CVE-2026-69673 High · 7.8 CWE-59 Oct 13, 2026

Windows Update Elevation of Privilege Vulnerability

Improper link resolution before file access ('link following') in Windows Update allows an authorized attacker to elevate privileges locally.

CVE-2026-69640 Medium · 5.3 CWE-863 Oct 13, 2026

Windows Key Distribution Center Security Feature Bypass Vulnerability

Incorrect authorization in Windows Key Distribution Center allows an authorized attacker to bypass a security feature over a network.

CVE-2026-69639 Critical · 9.8 CWE-122 Oct 13, 2026

Windows libarchive Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows Libarchive allows an unauthorized attacker to execute code over a network.

CVE-2026-69635 Medium · 6.6 CWE-122 Oct 13, 2026

Windows Installer Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges with a physical attack.

CVE-2026-69634 Critical · 9.8 CWE-122 Oct 13, 2026

Windows iSCSI Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows iSCSI allows an unauthorized attacker to execute code over a network.

CVE-2026-69633 High · 7.8 CWE-122 Oct 13, 2026

Windows Update Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Update allows an authorized attacker to elevate privileges locally.

CVE-2026-69596 High · 7.0 CWE-416 Oct 13, 2026

Windows Program Compatibility Assistant Service Elevation of Privilege Vulnerability

Use after free in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.

CVE-2026-69521 High · 8.8 CWE-190 Oct 13, 2026

Windows iSCSI Remote Code Execution Vulnerability

Integer overflow or wraparound in Windows iSCSI allows an unauthorized attacker to execute code over a network.

CVE-2026-69506 Medium · 4.7 CWE-125 Oct 13, 2026

Windows Key Storage Provider Information Disclosure Vulnerability

Out-of-bounds read in Windows Key Storage Provider allows an authorized attacker to disclose information locally.

CVE-2026-69471 High · 7.8 CWE-122 Oct 13, 2026

Windows Installer Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.

CVE-2026-69452 High · 7.1 CWE-416 Oct 13, 2026

Windows Enterprise App Management Elevation of Privilege Vulnerability

Use after free in Windows Enterprise App Management allows an authorized attacker to elevate privileges over a network.

CVE-2026-69387 High · 7.0 CWE-416 Oct 13, 2026

Windows Error Reporting Elevation of Privilege Vulnerability

Use after free in Windows Error Reporting allows an authorized attacker to elevate privileges locally.

CVE-2026-69363 High · 8.0 CWE-122 Oct 13, 2026

Windows Error Reporting Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges over a network.

CVE-2026-69354 High · 7.8 CWE-122 Oct 13, 2026

Windows Error Reporting Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges locally.

CVE-2026-69326 High · 8.8 CWE-122 Oct 13, 2026

Graphic Fonts Remote Code Execution Vulnerability

Heap-based buffer overflow in Graphic Fonts allows an unauthorized attacker to execute code over a network.

CVE-2026-68836 High · 7.8 CWE-122 Oct 13, 2026

Windows kernel32.dll Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows kernel32.dll allows an authorized attacker to elevate privileges locally.

CVE-2026-62879 Medium · 5.5 CWE-306 Oct 13, 2026

Windows SmartScreen Tampering Vulnerability

Missing authentication for critical function in Windows SmartScreen allows an authorized attacker to perform tampering locally.

CVE-2026-62687 Medium · 5.5 CWE-59 Oct 13, 2026

Windows Backup Engine Information Disclosure Vulnerability

Improper link resolution before file access ('link following') in Windows Backup Engine allows an authorized attacker to disclose information locally.

CVE-2026-59116 Medium · 6.8 CWE-327 Oct 13, 2026

Windows Remote Desktop Security Feature Bypass Vulnerability

Use of a broken or risky cryptographic algorithm in Windows Remote Desktop allows an unauthorized attacker to bypass a security feature over a network.

CVE-2026-108396 High · 7.0 CWE-367 Oct 13, 2026

Windows Modern Device Management (MDM) Elevation of Privilege Vulnerability

Time-of-check time-of-use (toctou) race condition in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.

CVE-2026-108136 High · 7.8 CWE-416 Oct 13, 2026

Microsoft Windows Search Component Elevation of Privilege Vulnerability

Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.

CVE-2026-108135 High · 7.0 CWE-59 Oct 13, 2026

Windows Backup Engine Elevation of Privilege Vulnerability

Improper link resolution before file access ('link following') in Windows Backup Engine allows an authorized attacker to elevate privileges locally.

CVE-2026-108129 Medium · 6.5 CWE-125 Oct 13, 2026

Role: DNS Server Information Disclosure Vulnerability

Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.

CVE-2026-108128 Medium · 6.5 CWE-125 Oct 13, 2026

Role: DNS Server Information Disclosure Vulnerability

Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.

CVE-2026-108127 Medium · 6.5 CWE-125 Oct 13, 2026

Role: DNS Server Information Disclosure Vulnerability

Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.