Microsoft security briefs
4627 published alerts for Microsoft products and services.
Improper input validation in SVG in Microsoft Edge vulnerability
Improper input validation in SVG in Microsoft Edge vulnerability (CVE-2026-118304) was added to Microsoft’s security update guidance. This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information. If you need help checking exposure, call (864) 335-9223.
Microsoft Edge (Chromium-based) Elevation of Privilege vulnerability
Microsoft Edge (Chromium-based) Elevation of Privilege vulnerability (CVE-2026-69446) was added to Microsoft’s security update guidance. Corrected CVE by adding the assigning CNA. This is an informational change only. If you need help checking exposure, call (864) 335-9223.
Visual Studio Spoofing vulnerability
Visual Studio Spoofing vulnerability (CVE-2026-118147) was added to Microsoft’s security update guidance. Improper certificate validation in Visual Studio allows an unauthorized attacker to perform spoofing over a network. If you need help checking exposure, call (864) 335-9223.
Windows File Explorer Information Disclosure vulnerability
Windows File Explorer Information Disclosure vulnerability (CVE-2026-57084) was added to Microsoft’s security update guidance. Added supported editions of Microsoft Office to the Security Updates table because they are affected by this vulnerability. Microsoft recommends that customers running any of these editions of Office install the latest security updates to be fully protected from this vulnerabi… If you need help checking exposure, call (864) 335-9223.
Windows Media Photo Codec Information Disclosure vulnerability
Windows Media Photo Codec Information Disclosure vulnerability (CVE-2026-57083) was added to Microsoft’s security update guidance. Added supported editions of Microsoft Office to the Security Updates table because they are affected by this vulnerability. Microsoft recommends that customers running any of these editions of Office install the latest security updates to be fully protected from this vulnerabi… If you need help checking exposure, call (864) 335-9223.
Microsoft Edge (Chromium-based) Security Feature Bypass vulnerability
Microsoft Edge (Chromium-based) Security Feature Bypass vulnerability (CVE-2026-96196) was added to Microsoft’s security update guidance. Incomplete list of disallowed inputs in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network. If you need help checking exposure, call (864) 335-9223.
Microsoft Edge (Chromium-based) Spoofing vulnerability
Microsoft Edge (Chromium-based) Spoofing vulnerability (CVE-2026-88078) was added to Microsoft’s security update guidance. CWE added. Informational change only. If you need help checking exposure, call (864) 335-9223.
Windows Fast FAT File System Driver Information Disclosure vulnerability
Windows Fast FAT File System Driver Information Disclosure vulnerability (CVE-2026-70277) was added to Microsoft’s security update guidance. Updated an acknowledgement. This is an informational change only. If you need help checking exposure, call (864) 335-9223.
Microsoft Edge (Chromium-based) Remote Code Execution vulnerability
Microsoft Edge (Chromium-based) Remote Code Execution vulnerability (CVE-2026-62765) was added to Microsoft’s security update guidance. Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. If you need help checking exposure, call (864) 335-9223.
Microsoft Edge (Chromium-based) Spoofing vulnerability
Microsoft Edge (Chromium-based) Spoofing vulnerability (CVE-2026-20942) was added to Microsoft’s security update guidance. Improper restriction of rendered ui layers or frames in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. If you need help checking exposure, call (864) 335-9223.
Windows NetBIOS Elevation of Privilege vulnerability
Windows NetBIOS Elevation of Privilege vulnerability (CVE-2026-70054) was added to Microsoft’s security update guidance. Updated an acknowledgement. This is an informational change only. If you need help checking exposure, call (864) 335-9223.
Microsoft Exchange Online Remote Code Execution vulnerability
Microsoft Exchange Online Remote Code Execution vulnerability (CVE-2026-96185) was added to Microsoft’s security update guidance. Stack-based buffer overflow in Microsoft Exchange Online allows an authorized attacker to execute code over a network. If you need help checking exposure, call (864) 335-9223.
Azure Kubernetes Configuration Service Elevation of Privilege vulnerability
Azure Kubernetes Configuration Service Elevation of Privilege vulnerability (CVE-2026-83938) was added to Microsoft’s security update guidance. Missing authentication for critical function in Azure Kubernetes Configuration Service allows an unauthorized attacker to elevate privileges over a network. If you need help checking exposure, call (864) 335-9223.
Azure AI Foundry Elevation of Privilege vulnerability
Azure AI Foundry Elevation of Privilege vulnerability (CVE-2026-108456) was added to Microsoft’s security update guidance. Server-side request forgery (ssrf) in Azure AI Foundry allows an authorized attacker to elevate privileges over a network. If you need help checking exposure, call (864) 335-9223.
Azure Pipelines Remote Code Execution vulnerability
Azure Pipelines Remote Code Execution vulnerability (CVE-2026-105014) was added to Microsoft’s security update guidance. Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an unauthorized attacker to execute code over a network. If you need help checking exposure, call (864) 335-9223.
Windows NTFS Remote Code Execution vulnerability
Windows NTFS Remote Code Execution vulnerability (CVE-2026-69902) was added to Microsoft’s security update guidance. Updated an acknowledgement. This is an informational change only. If you need help checking exposure, call (864) 335-9223.
Windows DNS Information Disclosure vulnerability
Windows DNS Information Disclosure vulnerability (CVE-2026-70074) was added to Microsoft’s security update guidance. Updated an acknowledgement. This is an informational change only. If you need help checking exposure, call (864) 335-9223.
Windows Raw Image Extension Remote Code Execution vulnerability
Windows Raw Image Extension Remote Code Execution vulnerability (CVE-2026-96202) was added to Microsoft’s security update guidance. Heap-based buffer overflow in Windows Raw Image Extension allows an unauthorized attacker to execute code over a network. If you need help checking exposure, call (864) 335-9223.
Microsoft Edge (Chromium-based) Remote Code Execution vulnerability
Microsoft Edge (Chromium-based) Remote Code Execution vulnerability (CVE-2026-96199) was added to Microsoft’s security update guidance. Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. If you need help checking exposure, call (864) 335-9223.
Microsoft Edge (Chromium-based) Remote Code Execution vulnerability
Microsoft Edge (Chromium-based) Remote Code Execution vulnerability (CVE-2026-96198) was added to Microsoft’s security update guidance. Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. If you need help checking exposure, call (864) 335-9223.
Microsoft Edge (Chromium-based) Remote Code Execution vulnerability
Microsoft Edge (Chromium-based) Remote Code Execution vulnerability (CVE-2026-85898) was added to Microsoft’s security update guidance. Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. If you need help checking exposure, call (864) 335-9223.
Microsoft Edge (Chromium-based) Remote Code Execution vulnerability
Microsoft Edge (Chromium-based) Remote Code Execution vulnerability (CVE-2026-85897) was added to Microsoft’s security update guidance. Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. If you need help checking exposure, call (864) 335-9223.
Microsoft Edge (Chromium-based) Remote Code Execution vulnerability
Microsoft Edge (Chromium-based) Remote Code Execution vulnerability (CVE-2026-85890) was added to Microsoft’s security update guidance. Double free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. If you need help checking exposure, call (864) 335-9223.
Microsoft Edge (Chromium-based) Remote Code Execution vulnerability
Microsoft Edge (Chromium-based) Remote Code Execution vulnerability (CVE-2026-83831) was added to Microsoft’s security update guidance. Double free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. If you need help checking exposure, call (864) 335-9223.