Microsoft security briefs
3324 published alerts for Microsoft products and services.
Windows Routing and Remote Access Service (RRAS) Elevation of Privilege vulnerability
Windows Routing and Remote Access Service (RRAS) Elevation of Privilege vulnerability (CVE-2026-49791) was added to Microsoft’s security update guidance. Improper link resolution before file access ('link following') in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to elevate privileges locally. If you need help checking exposure, call (864) 335-9223.
Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege vulnerability
Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege vulnerability (CVE-2026-49790) was added to Microsoft’s security update guidance. Information published. If you need help checking exposure, call (864) 335-9223.
Windows NTFS Elevation of Privilege vulnerability
Windows NTFS Elevation of Privilege vulnerability (CVE-2026-49789) was added to Microsoft’s security update guidance. Stack-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally. If you need help checking exposure, call (864) 335-9223.
Microsoft Windows App Store Elevation of Privilege vulnerability
Microsoft Windows App Store Elevation of Privilege vulnerability (CVE-2026-49784) was added to Microsoft’s security update guidance. Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Windows App Store allows an authorized attacker to elevate privileges locally. If you need help checking exposure, call (864) 335-9223.
Windows NTFS Remote Code Execution vulnerability
Windows NTFS Remote Code Execution vulnerability (CVE-2026-49184) was added to Microsoft’s security update guidance. Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally. If you need help checking exposure, call (864) 335-9223.
Windows DHCP Client Elevation of Privilege vulnerability
Windows DHCP Client Elevation of Privilege vulnerability (CVE-2026-49181) was added to Microsoft’s security update guidance. Integer underflow (wrap or wraparound) in Windows DHCP Client allows an unauthorized attacker to elevate privileges over a network. If you need help checking exposure, call (864) 335-9223.
Windows Active Directory Domain Services Remote Code Execution vulnerability
Windows Active Directory Domain Services Remote Code Execution vulnerability (CVE-2026-49178) was added to Microsoft’s security update guidance. Heap-based buffer overflow in Active Directory Domain Services allows an authorized attacker to execute code over a network. If you need help checking exposure, call (864) 335-9223.
Windows WalletService Elevation of Privilege vulnerability
Windows WalletService Elevation of Privilege vulnerability (CVE-2026-49176) was added to Microsoft’s security update guidance. Improper privilege management in Windows WalletService allows an authorized attacker to elevate privileges locally. If you need help checking exposure, call (864) 335-9223.
Windows DNS Client Elevation of Privilege vulnerability
Windows DNS Client Elevation of Privilege vulnerability (CVE-2026-49175) was added to Microsoft’s security update guidance. Heap-based buffer overflow in Windows DNS allows an authorized attacker to elevate privileges locally. If you need help checking exposure, call (864) 335-9223.
Windows Kernel Elevation of Privilege vulnerability
Windows Kernel Elevation of Privilege vulnerability (CVE-2026-49173) was added to Microsoft’s security update guidance. Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. If you need help checking exposure, call (864) 335-9223.
Windows FTP Service Remote Code Execution vulnerability
Windows FTP Service Remote Code Execution vulnerability (CVE-2026-49172) was added to Microsoft’s security update guidance. Heap-based buffer overflow in Windows FTP Service allows an unauthorized attacker to execute code over a network. If you need help checking exposure, call (864) 335-9223.
Windows Speech Runtime Elevation of Privilege vulnerability
Windows Speech Runtime Elevation of Privilege vulnerability (CVE-2026-49171) was added to Microsoft’s security update guidance. Use after free in Microsoft Windows Speech allows an authorized attacker to elevate privileges locally. If you need help checking exposure, call (864) 335-9223.
Windows StateRepository API Server file Elevation of Privilege vulnerability
Windows StateRepository API Server file Elevation of Privilege vulnerability (CVE-2026-49170) was added to Microsoft’s security update guidance. Insufficient granularity of access control in Windows StateRepository API allows an authorized attacker to elevate privileges locally. If you need help checking exposure, call (864) 335-9223.
Windows DNS Server Remote Code Execution vulnerability
Windows DNS Server Remote Code Execution vulnerability (CVE-2026-49169) was added to Microsoft’s security update guidance. Use after free in DNS Server allows an authorized attacker to execute code over a network. If you need help checking exposure, call (864) 335-9223.
Windows Kernel Elevation of Privilege vulnerability
Windows Kernel Elevation of Privilege vulnerability (CVE-2026-49167) was added to Microsoft’s security update guidance. Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. If you need help checking exposure, call (864) 335-9223.
Windows Print Configuration Elevation of Privilege vulnerability
Windows Print Configuration Elevation of Privilege vulnerability (CVE-2026-49166) was added to Microsoft’s security update guidance. Use after free in Microsoft Printer Drivers allows an authorized attacker to elevate privileges locally. If you need help checking exposure, call (864) 335-9223.
Microsoft Windows App Store Information Disclosure vulnerability
Microsoft Windows App Store Information Disclosure vulnerability (CVE-2026-49165) was added to Microsoft’s security update guidance. Use of uninitialized resource in Microsoft Windows App Store allows an authorized attacker to disclose information locally. If you need help checking exposure, call (864) 335-9223.
Windows Active Directory Domain Services Remote Code Execution vulnerability
Windows Active Directory Domain Services Remote Code Execution vulnerability (CVE-2026-49164) was added to Microsoft’s security update guidance. Heap-based buffer overflow in Active Directory Domain Services allows an unauthorized attacker to execute code over a network. If you need help checking exposure, call (864) 335-9223.
Microsoft Excel Information Disclosure vulnerability
Microsoft Excel Information Disclosure vulnerability (CVE-2026-48580) was added to Microsoft’s security update guidance. Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. If you need help checking exposure, call (864) 335-9223.
Windows App Package Installer Elevation of Privilege vulnerability
Windows App Package Installer Elevation of Privilege vulnerability (CVE-2026-48572) was added to Microsoft’s security update guidance. Concurrent execution using shared resource with improper synchronization ('race condition') in Windows App Installer allows an authorized attacker to elevate privileges locally. If you need help checking exposure, call (864) 335-9223.
Windows App Package Installer Elevation of Privilege vulnerability
Windows App Package Installer Elevation of Privilege vulnerability (CVE-2026-48571) was added to Microsoft’s security update guidance. Use after free in Windows App Installer allows an authorized attacker to elevate privileges locally. If you need help checking exposure, call (864) 335-9223.
Microsoft Excel Remote Code Execution vulnerability
Microsoft Excel Remote Code Execution vulnerability (CVE-2026-47642) was added to Microsoft’s security update guidance. Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. If you need help checking exposure, call (864) 335-9223.
Visual Studio Remote Code Execution vulnerability
Visual Studio Remote Code Execution vulnerability (CVE-2026-47305) was added to Microsoft’s security update guidance. Protection mechanism failure in Visual Studio allows an unauthorized attacker to execute code locally. If you need help checking exposure, call (864) 335-9223.
Microsoft SQL Server Elevation of Privilege vulnerability
Microsoft SQL Server Elevation of Privilege vulnerability (CVE-2026-47296) was added to Microsoft’s security update guidance. Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges locally. If you need help checking exposure, call (864) 335-9223.