Report Name: Microsoft Patch Tuesday, April 2026
Generated: 2026-04-16 00:15:59

Product Name	Prevalence	U	C	H	M	L	A	Comment
Microsoft Desktop Window Manager	0.95			5			5	Desktop Window Manager (DWM) is a core component of Microsoft Windows responsible for compositing and rendering the graphical user interface, including window effects, transparency, and desktop composition.
Active Directory	0.9				1		1	Active Directory is a directory service developed by Microsoft for Windows domain networks
Microsoft Windows UPnP Service	0.9			1			1	Universal Plug and Play (UPnP) in Microsoft Windows is a networking component that enables automatic discovery and interaction with networked devices, implemented in part via the upnp.dll library.
Windows Container Isolation FS Filter Driver	0.9			1			1	Windows component
Windows Kernel	0.9			3	4		7	Windows Kernel
Windows TCP/IP	0.9			1			1	Windows component
Windows Win32k	0.9			1	1		2	The Win32k.sys driver is the kernel side of some core parts of the Windows subsystem. Its main functionality is the GUI of Windows; it's responsible for window management.
AMD IOMMU	0.85				1		1	AMD IOMMU (Input Output Memory Management Unit) is a hardware feature in AMD processors that manages memory access for peripheral devices, providing isolation and virtualization support.
.NET Framework	0.8			1	1		2	.NET Framework
Microsoft Brokering File System	0.8			1	2		3	The Microsoft Brokering File System (BFS) is a Windows component designed to act as an intermediary for file access in isolated (sandboxed) Win32 applications
Microsoft Cryptographic Services	0.8			1			1	he Cryptographic Services is a Microsoft Windows feature that encrypts and decrypts data on storage devices when they are accessed
Microsoft Defender	0.8			1			1	Anti-malware component of Microsoft Windows
Microsoft Management Console	0.8			1			1	Microsoft Management Console (MMC) is a component of Microsoft Windows that provides system administrators and advanced users an interface for configuring and monitoring the system
Microsoft Office	0.8			1			1	Microsoft Office is a suite of applications designed to help with productivity and completing common tasks on a computer
Microsoft PowerShell	0.8			2			2	PowerShell or Microsoft PowerShell (formerly Windows PowerShell) is a task automation and configuration management program from Microsoft, consisting of a command-line shell and the associated scripting language
Secure Boot	0.8				1		1	Secure boot is a security standard developed by members of the PC industry to help make sure that a device boots using only software that is trusted by the Original Equipment Manufacturer (OEM)
Windows Active Directory	0.8			1			1	Windows component
Windows Admin Center	0.8				1		1	Windows component
Windows Advanced Rasterization Platform	0.8			1			1	Windows component
Windows Ancillary Function Driver for WinSock	0.8			1	7		8	Windows component
Windows Biometric Service	0.8				1		1	Windows component
Windows BitLocker	0.8			1			1	Windows component
Windows Boot Manager	0.8			1			1	Windows component
Windows COM	0.8				1		1	Windows component
Windows COM Server	0.8				1		1	Windows component
Windows Client Side Caching driver (csc.sys)	0.8			1			1	Windows component
Windows Cloud Files Mini Filter Driver	0.8				1		1	Windows component
Windows Common Log File System Driver	0.8				1		1	Common Log File System is a general-purpose logging subsystem that is accessible to both kernel-mode as well as user-mode applications for building high-performance transaction logs
Windows Encrypted File System (EFS)	0.8			1			1	Windows component
Windows Function Discovery Service (fdwsd.dll)	0.8				4		4	Windows component
Windows GDI	0.8				2		2	Windows component
Windows Graphics Component	0.8			1			1	Windows component
Windows Hello	0.8			1	1		2	Windows component
Windows Installer	0.8				1		1	Windows component
Windows Internet Key Exchange (IKE) Service Extensions	0.8			1			1	Windows component
Windows Kerberos	0.8			1			1	Windows component
Windows Kernel Memory	0.8				1		1	Windows component
Windows LUA File Virtualization Filter Driver	0.8				1		1	Windows component
Windows Local Security Authority Subsystem Service (LSASS)	0.8				1		1	Windows component
Windows Management Services	0.8			1			1	Windows component
Windows OLE	0.8			1			1	Windows component
Windows Print Spooler	0.8				2		2	Windows component
Windows Projected File System	0.8			1	4		5	Windows component
Windows Push Notifications	0.8			2	3		5	Windows component
Windows Recovery Environment	0.8			1			1	Windows component
Windows Redirected Drive Buffering System	0.8				1		1	Windows component
Windows Remote Desktop Client	0.8			1			1	Remote Desktop Protocol Client
Windows Search Service	0.8			1			1	Windows component
Windows Sensor Data Service	0.8			1			1	Windows component
Windows Server Update Service (WSUS)	0.8				3		3	Windows component
Windows Shell	0.8			1	5		6	Windows component
Windows Simple Search and Discovery Protocol (SSDP) Service	0.8				3		3	Windows component
Windows Snipping Tool	0.8			1	1		2	Windows component
Windows Speech Brokered Api	0.8				2		2	Windows component
Windows Speech Runtime	0.8				1		1	Windows component
Windows Storage Spaces Controller	0.8			1	1		2	Windows component
Windows TDI Translation Driver (tdx.sys)	0.8				2		2	Windows component
Windows UPnP Device Host	0.8			1	7		8	Windows component
Windows USB Printing Stack (usbprint.sys)	0.8				1		1	Windows component
Windows User Interface Core	0.8				4		4	Windows component
Windows Virtualization-Based Security (VBS)	0.8				1		1	Windows component
Windows WFP NDIS Lightweight Filter Driver (wfplwfs.sys)	0.8				1		1	Windows component
Windows WalletService	0.8				1		1	Windows component
.NET	0.7			1	1		2	.NET
.NET and Visual Studio	0.7			1			1	.NET and Visual Studio
Microsoft Excel	0.6				5		5	MS Office product
Microsoft PowerPoint	0.6				1		1	Microsoft PowerPoint
Microsoft Word	0.6				5		5	Microsoft Word is a widely used commercial word processor developed by Microsoft. It is a component of the Microsoft Office suite of productivity software but can also be purchased as a standalone product.
Windows Hyper-V	0.6			1	1		2	Hardware virtualization component of the client editions of Windows NT
.NET, .NET Framework, and Visual Studio	0.5				1		1	.NET, .NET Framework, and Visual Studio
Applocker Filter Driver (applockerfltr.sys)	0.5				1		1	Applocker Filter Driver (applockerfltr.sys)
Azure Logic Apps	0.5				1		1	Azure Logic Apps
Azure Monitor Agent	0.5			1	1		2	Azure Monitor Agent
Connected User Experiences and Telemetry Service	0.5				1		1	Connected User Experiences and Telemetry Service
GitHub Copilot and Visual Studio Code	0.5				1		1	GitHub Copilot and Visual Studio Code
HTTP.sys	0.5				1		1	HTTP.sys
Microsoft Dynamics 365 (On-Premises)	0.5				1		1	Microsoft Dynamics 365 (On-Premises)
Microsoft High Performance Compute (HPC) Pack	0.5			1			1	Microsoft High Performance Compute (HPC) Pack
Microsoft Local Security Authority Subsystem Service	0.5				1		1	Microsoft Local Security Authority Subsystem Service
Microsoft Power Apps	0.5				1		1	Microsoft Power Apps
Microsoft SQL Server	0.5				1		1	Microsoft SQL Server
Microsoft SharePoint Server	0.5		1		1		2	Microsoft SharePoint Server
Node.js	0.5				1		1	Product detected by a:nodejs:node.js (exists in CPE dict)
Package Catalog	0.5				1		1	Package Catalog
Remote Access Management service/API (RPC server)	0.5				1		1	Remote Access Management service/API (RPC server)
Remote Desktop	0.5				1		1	Remote Desktop
Remote Desktop Licensing Service	0.5				2		2	Remote Desktop Licensing Service
Remote Procedure Call	0.5				1		1	Remote Procedure Call
SQL Server	0.5				2		2	SQL Server
UEFI Secure Boot	0.5				2		2	UEFI Secure Boot
Universal Plug and Play (upnp.dll)	0.5				1		1	Universal Plug and Play (upnp.dll)
Web Account Manager	0.5				1		1	Web Account Manager
GitHub	0.2				1		1	GitHub, Inc. is an Internet hosting service for software development and version control using Git

Vulnerability Type	Criticality	U	C	H	M	L	A
Remote Code Execution	1.0			9	11		20
Authentication Bypass	0.98			1			1
Security Feature Bypass	0.9			7	8		15
Elevation of Privilege	0.85			30	63		93
Information Disclosure	0.83				20		20
Denial of Service	0.7			2	7		9
Memory Corruption	0.5				1		1
Spoofing	0.4		1		6		7
Tampering	0.3				1		1

Source	U	C	H	M	L	A
Qualys		1	13	14		28
Tenable		1	4	2		7
ZDI		1	4			5

Urgent (0)

Critical (1)

1. Spoofing - Microsoft SharePoint Server (CVE-2026-32201) - Critical [669]

Description: Microsoft SharePoint Server Spoofing Vulnerability

Qualys: CVE-2026-32201: Microsoft SharePoint Server Spoofing Vulnerability An improper input validation vulnerability in Microsoft Office SharePoint may allow an unauthenticated attacker to perform network spoofing. CISA acknowledged the active exploitation of the vulnerability by adding it to its Known Exploited Vulnerabilities Catalog. CISA urges users to patch the vulnerability before April 28, 2026.

Tenable: Microsoft’s April 2026 Patch Tuesday Addresses 163 CVEs (CVE-2026-32201)

Tenable: CVE-2026-20945 and CVE-2026-32201 | Microsoft SharePoint Server Spoofing Vulnerability

Tenable: CVE-2026-20945 and CVE-2026-32201 are spoofing vulnerabilities affecting Microsoft SharePoint. CVE-2026-20945 received a CVSSv3 score of 4.6, while CVE-2026-32201 received a score of 6.5. According to Microsoft, CVE-2026-32201 was exploited in the wild as a zero-day. Microsoft has released updates for SharePoint 2016, 2019 and SharePoint Server Subscription Edition to address these flaws.

ZDI: CVE-2026-32201 - Microsoft SharePoint Server Spoofing Vulnerability. Microsoft doesn’t provide a lot of information about this bug, but Spoofing bugs in SharePoint often manifest as cross-site scripting (XSS) bugs. They do note that attackers could view information or make changes to disclosed information. As always, they don’t provide any information on how widespread these attacks are, but I wouldn’t wait to test and deploy this fix – especially if you have internet-connected SharePoint servers.

High (49)

2. Remote Code Execution - Windows Active Directory (CVE-2026-33826) - High [478]

Description: Windows Active Directory Remote Code Execution Vulnerability

Qualys: CVE-2026-33826: Windows Active Directory Remote Code Execution Vulnerability An improper input validation flaw in Windows Active Directory could allow an authenticated attacker to execute code on an adjacent network. An attacker must send a specially crafted RPC call to an RPC host to exploit the vulnerability.

Tenable: CVE-2026-33826 | Windows Active Directory Remote Code Execution Vulnerability

Tenable: CVE-2026-33826 is a RCE vulnerability affecting Windows Active Directory. It received a CVSSv3 score of 8, was rated as critical and was assessed as “Exploitation More Likely” according to Microsoft’s Exploitability Index. Successful exploitation requires an authenticated attacker to send a specially crafted RPC call to a vulnerable RPC host, resulting in code execution with the same permissions as the RPC host. Despite the exploitation assessment and severity, the Microsoft advisory does note that an attacker would need to be in the “same restricted Active Directory domain as the target system” in order to exploit this flaw.

3. Elevation of Privilege - Microsoft Defender (CVE-2026-33825) - High [473]

Description: Microsoft Defender Elevation of Privilege Vulnerability

Qualys: CVE-2026-33825: Microsoft Defender Elevation of Privilege Vulnerability Microsoft Defender is a comprehensive, AI-powered security suite that provides malware protection, phishing detection, and web protection for individuals and businesses. An insufficient access-control granularity flaw in Windows Defender could allow an authenticated attacker to elevate local privileges. Insufficient Granularity of Access Control occurs when security policies are too broad, allowing authorized users to access data or perform actions beyond their intended permissions.

Tenable: CVE-2026-33825 | Microsoft Defender Elevation of Privilege Vulnerability

Tenable: CVE-2026-33825 is an EoP vulnerability in Microsoft Defender. It received a CVSSv3 score of 7.8 and was rated important. According to Microsoft, this flaw was publicly disclosed prior to a patch being made available. While Microsoft’s advisory made no mention of public exploit code, the description appears to match a zero-day exploit, known as BlueHammer, with code posted to GitHub on April 3rd. A researcher using the alias "Chaotic Eclipse" released the exploit and expressed concern about Microsoft’s handling of the vulnerability disclosure process.

ZDI: CVE-2026-33825 - Microsoft Defender Elevation of Privilege Vulnerability. This bug is listed as publicly known, and this time, we know exactly where it was disclosed. There have been some questions about how exploitable this bug may be, but it does look like it’s a real problem – just with some reliability issues in its current state. I won’t add on to the commentary from the researcher about working with Microsoft. I’m just glad they are offering a fix for the vulnerability. If you rely on Defender, test and deploy this one quickly.

4. Denial of Service - .NET Framework (CVE-2026-23666) - High [458]

Description: .NET Framework Denial of Service Vulnerability

Qualys: CVE-2026-23666: .NET Framework Denial of Service Vulnerability A race condition flaw in the .NET Framework could allow an unauthenticated attacker to deny service to network clients.

5. Remote Code Execution - Windows Internet Key Exchange (IKE) Service Extensions (CVE-2026-33824) - High [454]

Description: Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability

Qualys: CVE-2026-33824: Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability Windows Internet Key Exchange is a foundational network security protocol used by Windows to set up secure, encrypted IPsec tunnels, primarily for VPN connections. An unauthenticated attacker could send specially crafted packets to a Windows machine with Internet Key Exchange version 2 enabled, potentially leading to remote code execution.

Tenable: CVE-2026-33824 | Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability

Tenable: CVE-2026-33824 is a RCE affecting Windows Internet Key Exchange (IKE) Service Extensions. It received a CVSSv3 score of 9.8 and was rated as critical. This vulnerability can be exploited by an unauthenticated attacker by sending crafted packets to a target with IKE version 2 enabled. Microsoft’s advisory includes some mitigations that can be applied in the event immediate patching cannot be performed. This includes firewall rules for UDP ports 500 and 4500.

ZDI: CVE-2026-33824 - Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability. Speaking of wormable bugs, here’s our second one this month. By the title, we can tell that systems with IKE enabled are affected, but that leaves plenty of targets for attackers. Microsoft also notes a significant mitigation for this bug. Blocking UDP ports 500 and 4500 at the perimeter prevents external attackers from reaching the affected service. However, insiders could still target this for lateral movement within an enterprise. For enterprises using IKE, get this fix tested and deployed with haste.

6. Remote Code Execution - Windows Remote Desktop Client (CVE-2026-32157) - High [454]

Description: Remote Desktop Client Remote Code Execution Vulnerability

Qualys: CVE-2026-32157: Remote Desktop Client Remote Code Execution Vulnerability A use-after-free flaw in the Remote Desktop Client may allow an unauthenticated attacker to execute code over the network. Successful exploitation of the vulnerability requires an authenticated user on the client to connect to a malicious server.

7. Remote Code Execution - Windows TCP/IP (CVE-2026-33827) - High [447]

Description: Windows TCP/IP Remote Code Execution Vulnerability

Qualys: CVE-2026-33827: Windows TCP/IP Remote Code Execution Vulnerability A race condition flaw in Windows TCP/IP may allow an unauthenticated attacker to execute code over a network. An attacker could send a specially crafted IPv6 packet to a Windows node with IPSec enabled, leading to remote code execution.

ZDI: CVE-2026-33827 - Windows TCP/IP Remote Code Execution Vulnerability. This vulnerability allows remote, unauthenticated attackers to exploit code on affected systems without user interaction. That adds up to a wormable bug – at least on systems with IPv6 and IPSec enabled. It is a race condition, which sets exploitability to High on the CVSS scale, but we see race conditions exploited at Pwn2Own all the time, so don’t rely on that obstacle. If you’re running IPv6, I would test and deploy this fix quickly before public exploits become available.

8. Elevation of Privilege - Windows Advanced Rasterization Platform (CVE-2026-26178) - High [439]

Description: Windows Advanced Rasterization Platform Elevation of Privilege Vulnerability

9. Elevation of Privilege - Windows Kerberos (CVE-2026-27912) - High [439]

Description: Windows Kerberos Elevation of Privilege Vulnerability

10. Remote Code Execution - Windows Snipping Tool (CVE-2026-32183) - High [430]

Description: Windows Snipping Tool Remote Code Execution Vulnerability

11. Elevation of Privilege - Windows OLE (CVE-2026-26162) - High [427]

Description: Windows OLE Elevation of Privilege Vulnerability

12. Security Feature Bypass - Microsoft PowerShell (CVE-2026-26143) - High [425]

Description: Microsoft PowerShell Security Feature Bypass Vulnerability

13. Security Feature Bypass - Windows Hello (CVE-2026-27928) - High [425]

Description: Windows Hello Security Feature Bypass Vulnerability

14. Security Feature Bypass - Windows Shell (CVE-2026-32225) - High [425]

Description: Windows Shell Security Feature Bypass Vulnerability

Qualys: Other Microsoft Vulnerability Highlights CVE-2026-26151 is a spoofing vulnerability in Remote Desktop. Successful exploitation of the vulnerability allows an unauthenticated attacker to perform network spoofing. CVE-2026-27906 is a security feature bypass vulnerability in Windows Hello. Successful exploitation of the vulnerability may allow an authenticated attacker to bypass a local security feature. CVE-2026-27908 is an elevation-of-privilege vulnerability in the Windows TDI Translation Driver (tdx.sys). A use-after-free flaw may allow an authenticated attacker to gain SYSTEM privileges. CVE-2026-27921 is an elevation-of-privilege vulnerability in the Windows TDI Translation Driver (tdx.sys). An attacker may exploit the vulnerability to gain SYSTEM privileges. CVE-2026-32093 is an elevation-of-privilege vulnerability in the Windows Function Discovery Service (fdwsd.dll). An authenticated attacker who successfully exploited this vulnerability could gain administrator privileges. CVE-2026-32152 and CVE-2026-32154 are elevation-of-privilege vulnerabilities in the DesktopWindow Manager. A use-after-free flaw may allow an authenticated attacker to gain SYSTEM privileges. CVE-2026-0390 is a security feature bypass vulnerability in the Windows Boot Loader. Successful exploitation of the vulnerability may allow an authenticated attacker to bypass a local security feature. CVE-2026-32202 is a spoofing vulnerability in the Windows Shell. An unauthenticated attacker may exploit the vulnerability to perform network spoofing. CVE-2026-26169 is an information disclosure vulnerability in Windows Kernel Memory. An authenticated attacker may exploit the vulnerability to disclose information locally. CVE-2026-26173 is an elevation-of-privilege vulnerability in the Windows Ancillary Function Driver for WinSock. A race condition flaw may allow an authenticated attacker to gain SYSTEM privileges. CVE-2026-27909 is an elevation-of-privilege vulnerability in the Windows Search Service. A use-after-free flaw may allow an authenticated attacker to gain SYSTEM privileges. CVE-2026-27913 is a security feature bypass vulnerability in the Windows BitLocker. An improper input validation flaw may allow an unauthenticated attacker to bypass a local security feature. CVE-2026-27914 is an elevation-of-privilege vulnerability in the Microsoft Management Console. Successful exploitation of the vulnerability may allow an authenticated attacker to gain SYSTEM privileges. CVE-2026-32070 is an elevation-of-privilege vulnerability in the Windows Common Log File System Driver. A use-after-free flaw may allow an authenticated attacker to gain SYSTEM privileges. CVE-2026-32162 is an elevation-of-privilege vulnerability in Windows COM. Successful exploitation of the vulnerability may allow an unauthenticated attacker to gain SYSTEM privileges. CVE-2026-32225 is a security feature bypass vulnerability in Windows Shell. Successful exploitation of the vulnerability may allow an unauthenticated attacker to bypass a network security feature. CVE-2026-32075 is an elevation-of-privilege vulnerability in the Windows UPnP Device Host. Successful exploitation of the vulnerability may allow an authenticated attacker to gain administrator privileges.

15. Denial of Service - .NET (CVE-2026-26171) - High [420]

Description: .NET Denial of Service Vulnerability

16. Elevation of Privilege - Windows Kernel (CVE-2026-26163) - High [420]

Description: Windows Kernel Elevation of Privilege Vulnerability

17. Elevation of Privilege - Windows Kernel (CVE-2026-26179) - High [420]

Description: Windows Kernel Elevation of Privilege Vulnerability

18. Elevation of Privilege - Windows Kernel (CVE-2026-26180) - High [420]

Description: Windows Kernel Elevation of Privilege Vulnerability

19. Remote Code Execution - Microsoft Office (CVE-2026-32190) - High [419]

Description: Microsoft Office Remote Code Execution Vulnerability

Qualys: CVE-2026-32190: Microsoft Office Remote Code Execution Vulnerability A use-after-free vulnerability in Microsoft Office may allow an unauthenticated attacker to execute code locally.

20. Remote Code Execution - Windows Graphics Component (CVE-2026-32221) - High [419]

Description: Windows Graphics Component Remote Code Execution Vulnerability

21. Elevation of Privilege - Microsoft Desktop Window Manager (CVE-2026-27923) - High [417]

Description: Desktop Window Manager Elevation of Privilege Vulnerability

22. Elevation of Privilege - Microsoft Desktop Window Manager (CVE-2026-27924) - High [417]

Description: Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally.

23. Elevation of Privilege - Microsoft Desktop Window Manager (CVE-2026-32152) - High [417]

Description: Desktop Window Manager Elevation of Privilege Vulnerability

Qualys: Other Microsoft Vulnerability Highlights CVE-2026-26151 is a spoofing vulnerability in Remote Desktop. Successful exploitation of the vulnerability allows an unauthenticated attacker to perform network spoofing. CVE-2026-27906 is a security feature bypass vulnerability in Windows Hello. Successful exploitation of the vulnerability may allow an authenticated attacker to bypass a local security feature. CVE-2026-27908 is an elevation-of-privilege vulnerability in the Windows TDI Translation Driver (tdx.sys). A use-after-free flaw may allow an authenticated attacker to gain SYSTEM privileges. CVE-2026-27921 is an elevation-of-privilege vulnerability in the Windows TDI Translation Driver (tdx.sys). An attacker may exploit the vulnerability to gain SYSTEM privileges. CVE-2026-32093 is an elevation-of-privilege vulnerability in the Windows Function Discovery Service (fdwsd.dll). An authenticated attacker who successfully exploited this vulnerability could gain administrator privileges. CVE-2026-32152 and CVE-2026-32154 are elevation-of-privilege vulnerabilities in the DesktopWindow Manager. A use-after-free flaw may allow an authenticated attacker to gain SYSTEM privileges. CVE-2026-0390 is a security feature bypass vulnerability in the Windows Boot Loader. Successful exploitation of the vulnerability may allow an authenticated attacker to bypass a local security feature. CVE-2026-32202 is a spoofing vulnerability in the Windows Shell. An unauthenticated attacker may exploit the vulnerability to perform network spoofing. CVE-2026-26169 is an information disclosure vulnerability in Windows Kernel Memory. An authenticated attacker may exploit the vulnerability to disclose information locally. CVE-2026-26173 is an elevation-of-privilege vulnerability in the Windows Ancillary Function Driver for WinSock. A race condition flaw may allow an authenticated attacker to gain SYSTEM privileges. CVE-2026-27909 is an elevation-of-privilege vulnerability in the Windows Search Service. A use-after-free flaw may allow an authenticated attacker to gain SYSTEM privileges. CVE-2026-27913 is a security feature bypass vulnerability in the Windows BitLocker. An improper input validation flaw may allow an unauthenticated attacker to bypass a local security feature. CVE-2026-27914 is an elevation-of-privilege vulnerability in the Microsoft Management Console. Successful exploitation of the vulnerability may allow an authenticated attacker to gain SYSTEM privileges. CVE-2026-32070 is an elevation-of-privilege vulnerability in the Windows Common Log File System Driver. A use-after-free flaw may allow an authenticated attacker to gain SYSTEM privileges. CVE-2026-32162 is an elevation-of-privilege vulnerability in Windows COM. Successful exploitation of the vulnerability may allow an unauthenticated attacker to gain SYSTEM privileges. CVE-2026-32225 is a security feature bypass vulnerability in Windows Shell. Successful exploitation of the vulnerability may allow an unauthenticated attacker to bypass a network security feature. CVE-2026-32075 is an elevation-of-privilege vulnerability in the Windows UPnP Device Host. Successful exploitation of the vulnerability may allow an authenticated attacker to gain administrator privileges.

24. Elevation of Privilege - Microsoft Desktop Window Manager (CVE-2026-32154) - High [417]

Description: Desktop Window Manager Elevation of Privilege Vulnerability

Qualys: Other Microsoft Vulnerability Highlights CVE-2026-26151 is a spoofing vulnerability in Remote Desktop. Successful exploitation of the vulnerability allows an unauthenticated attacker to perform network spoofing. CVE-2026-27906 is a security feature bypass vulnerability in Windows Hello. Successful exploitation of the vulnerability may allow an authenticated attacker to bypass a local security feature. CVE-2026-27908 is an elevation-of-privilege vulnerability in the Windows TDI Translation Driver (tdx.sys). A use-after-free flaw may allow an authenticated attacker to gain SYSTEM privileges. CVE-2026-27921 is an elevation-of-privilege vulnerability in the Windows TDI Translation Driver (tdx.sys). An attacker may exploit the vulnerability to gain SYSTEM privileges. CVE-2026-32093 is an elevation-of-privilege vulnerability in the Windows Function Discovery Service (fdwsd.dll). An authenticated attacker who successfully exploited this vulnerability could gain administrator privileges. CVE-2026-32152 and CVE-2026-32154 are elevation-of-privilege vulnerabilities in the DesktopWindow Manager. A use-after-free flaw may allow an authenticated attacker to gain SYSTEM privileges. CVE-2026-0390 is a security feature bypass vulnerability in the Windows Boot Loader. Successful exploitation of the vulnerability may allow an authenticated attacker to bypass a local security feature. CVE-2026-32202 is a spoofing vulnerability in the Windows Shell. An unauthenticated attacker may exploit the vulnerability to perform network spoofing. CVE-2026-26169 is an information disclosure vulnerability in Windows Kernel Memory. An authenticated attacker may exploit the vulnerability to disclose information locally. CVE-2026-26173 is an elevation-of-privilege vulnerability in the Windows Ancillary Function Driver for WinSock. A race condition flaw may allow an authenticated attacker to gain SYSTEM privileges. CVE-2026-27909 is an elevation-of-privilege vulnerability in the Windows Search Service. A use-after-free flaw may allow an authenticated attacker to gain SYSTEM privileges. CVE-2026-27913 is a security feature bypass vulnerability in the Windows BitLocker. An improper input validation flaw may allow an unauthenticated attacker to bypass a local security feature. CVE-2026-27914 is an elevation-of-privilege vulnerability in the Microsoft Management Console. Successful exploitation of the vulnerability may allow an authenticated attacker to gain SYSTEM privileges. CVE-2026-32070 is an elevation-of-privilege vulnerability in the Windows Common Log File System Driver. A use-after-free flaw may allow an authenticated attacker to gain SYSTEM privileges. CVE-2026-32162 is an elevation-of-privilege vulnerability in Windows COM. Successful exploitation of the vulnerability may allow an unauthenticated attacker to gain SYSTEM privileges. CVE-2026-32225 is a security feature bypass vulnerability in Windows Shell. Successful exploitation of the vulnerability may allow an unauthenticated attacker to bypass a network security feature. CVE-2026-32075 is an elevation-of-privilege vulnerability in the Windows UPnP Device Host. Successful exploitation of the vulnerability may allow an authenticated attacker to gain administrator privileges.

25. Elevation of Privilege - Microsoft Desktop Window Manager (CVE-2026-32155) - High [417]

Description: Desktop Window Manager Elevation of Privilege Vulnerability

26. Elevation of Privilege - Microsoft PowerShell (CVE-2026-26170) - High [416]

Description: PowerShell Elevation of Privilege Vulnerability

27. Elevation of Privilege - Windows Push Notifications (CVE-2026-26167) - High [416]

Description: Windows Push Notifications Elevation of Privilege Vulnerability

ZDI: More than half of this release addresses Elevation of Privilege (EoP) bugs. However, most simply lead to local attackers executing their code at SYSTEM-level privileges or administrative privileges, so there’s not much to add without further technical details about the bugs themselves. The bugs in SQL Server could allow an attacker to gain SQL sysadmin privileges. One of the kernel bugs simply states an attacker could “elevate privileges locally”. How obtuse. That’s similar for the bug in afd.sys and Desktop Windows Manager, but Microsoft also states that these bugs could crash an affected system. There are several bugs that result in a sandbox escape, including Windows Push Notifications, AFD for Winsock, Management Services, and User Interface Core. Of these, CVE-2026-26167 (Push Notifications) is the most notable — it's the only one with low attack complexity, meaning no race condition needed. The rest all require winning a race condition (AC:H). The bugs in UPnP are interesting as they allow attackers to gain access to a limited set of administrator-protected objects. Not a full escalation but definitely getting access to resources they shouldn’t. The vulnerability in the Brokering File System allows attackers to gain the level of the logged on user, so don’t do your normal activities as a user with admin privileges. The bug in Azure Monitor Agent leads to root-level access.

28. Elevation of Privilege - Windows Sensor Data Service (CVE-2026-26161) - High [416]

Description: Windows Sensor Data Service Elevation of Privilege Vulnerability

29. Security Feature Bypass - Windows BitLocker (CVE-2026-27913) - High [413]

Description: Windows BitLocker Security Feature Bypass Vulnerability

Qualys: Other Microsoft Vulnerability Highlights CVE-2026-26151 is a spoofing vulnerability in Remote Desktop. Successful exploitation of the vulnerability allows an unauthenticated attacker to perform network spoofing. CVE-2026-27906 is a security feature bypass vulnerability in Windows Hello. Successful exploitation of the vulnerability may allow an authenticated attacker to bypass a local security feature. CVE-2026-27908 is an elevation-of-privilege vulnerability in the Windows TDI Translation Driver (tdx.sys). A use-after-free flaw may allow an authenticated attacker to gain SYSTEM privileges. CVE-2026-27921 is an elevation-of-privilege vulnerability in the Windows TDI Translation Driver (tdx.sys). An attacker may exploit the vulnerability to gain SYSTEM privileges. CVE-2026-32093 is an elevation-of-privilege vulnerability in the Windows Function Discovery Service (fdwsd.dll). An authenticated attacker who successfully exploited this vulnerability could gain administrator privileges. CVE-2026-32152 and CVE-2026-32154 are elevation-of-privilege vulnerabilities in the DesktopWindow Manager. A use-after-free flaw may allow an authenticated attacker to gain SYSTEM privileges. CVE-2026-0390 is a security feature bypass vulnerability in the Windows Boot Loader. Successful exploitation of the vulnerability may allow an authenticated attacker to bypass a local security feature. CVE-2026-32202 is a spoofing vulnerability in the Windows Shell. An unauthenticated attacker may exploit the vulnerability to perform network spoofing. CVE-2026-26169 is an information disclosure vulnerability in Windows Kernel Memory. An authenticated attacker may exploit the vulnerability to disclose information locally. CVE-2026-26173 is an elevation-of-privilege vulnerability in the Windows Ancillary Function Driver for WinSock. A race condition flaw may allow an authenticated attacker to gain SYSTEM privileges. CVE-2026-27909 is an elevation-of-privilege vulnerability in the Windows Search Service. A use-after-free flaw may allow an authenticated attacker to gain SYSTEM privileges. CVE-2026-27913 is a security feature bypass vulnerability in the Windows BitLocker. An improper input validation flaw may allow an unauthenticated attacker to bypass a local security feature. CVE-2026-27914 is an elevation-of-privilege vulnerability in the Microsoft Management Console. Successful exploitation of the vulnerability may allow an authenticated attacker to gain SYSTEM privileges. CVE-2026-32070 is an elevation-of-privilege vulnerability in the Windows Common Log File System Driver. A use-after-free flaw may allow an authenticated attacker to gain SYSTEM privileges. CVE-2026-32162 is an elevation-of-privilege vulnerability in Windows COM. Successful exploitation of the vulnerability may allow an unauthenticated attacker to gain SYSTEM privileges. CVE-2026-32225 is a security feature bypass vulnerability in Windows Shell. Successful exploitation of the vulnerability may allow an unauthenticated attacker to bypass a network security feature. CVE-2026-32075 is an elevation-of-privilege vulnerability in the Windows UPnP Device Host. Successful exploitation of the vulnerability may allow an authenticated attacker to gain administrator privileges.

Tenable: CVE-2026-27913 | Windows BitLocker Security Feature Bypass Vulnerability

Tenable: CVE-2026-27913 is a security feature bypass vulnerability affecting Windows BitLocker. It received a CVSSv3 score of 7.7 and was rated as important. Successful exploitation could allow an attacker to bypass Secure Boot, a UEFI firmware security feature used to allow only trusted and properly signed software runs during the startup process. While there’s no known exploitation of this vulnerability as of the time this blog was published, Microsoft assesses this vulnerability as “Exploitation More Likely.”

30. Remote Code Execution - Windows Hyper-V (CVE-2026-26156) - High [409]

Description: Windows Hyper-V Remote Code Execution Vulnerability

31. Authentication Bypass - Microsoft Windows UPnP Service (CVE-2026-32214) - High [408]

Description: Improper access control in Universal Plug and Play (upnp.dll) allows an authorized attacker to disclose information locally.

32. Elevation of Privilege - Windows Container Isolation FS Filter Driver (CVE-2026-33098) - High [408]

Description: Windows Container Isolation FS Filter Driver Elevation of Privilege Vulnerability

33. Elevation of Privilege - Windows Win32k (CVE-2026-32222) - High [408]

Description: Windows Win32k Elevation of Privilege Vulnerability

34. Security Feature Bypass - .NET and Visual Studio (CVE-2026-32203) - High [408]

Description: Stack-based buffer overflow in .NET and Visual Studio allows an unauthorized attacker to deny service over a network.

35. Remote Code Execution - Windows UPnP Device Host (CVE-2026-32156) - High [407]

Description: Windows UPnP Device Host Remote Code Execution Vulnerability

36. Elevation of Privilege - Microsoft Brokering File System (CVE-2026-26181) - High [404]

Description: Microsoft Brokering File System Elevation of Privilege Vulnerability

37. Elevation of Privilege - Microsoft Cryptographic Services (CVE-2026-26152) - High [404]

Description: Microsoft Cryptographic Services Elevation of Privilege Vulnerability

38. Elevation of Privilege - Microsoft Management Console (CVE-2026-27914) - High [404]

Description: Microsoft Management Console Elevation of Privilege Vulnerability

Qualys: Other Microsoft Vulnerability Highlights CVE-2026-26151 is a spoofing vulnerability in Remote Desktop. Successful exploitation of the vulnerability allows an unauthenticated attacker to perform network spoofing. CVE-2026-27906 is a security feature bypass vulnerability in Windows Hello. Successful exploitation of the vulnerability may allow an authenticated attacker to bypass a local security feature. CVE-2026-27908 is an elevation-of-privilege vulnerability in the Windows TDI Translation Driver (tdx.sys). A use-after-free flaw may allow an authenticated attacker to gain SYSTEM privileges. CVE-2026-27921 is an elevation-of-privilege vulnerability in the Windows TDI Translation Driver (tdx.sys). An attacker may exploit the vulnerability to gain SYSTEM privileges. CVE-2026-32093 is an elevation-of-privilege vulnerability in the Windows Function Discovery Service (fdwsd.dll). An authenticated attacker who successfully exploited this vulnerability could gain administrator privileges. CVE-2026-32152 and CVE-2026-32154 are elevation-of-privilege vulnerabilities in the DesktopWindow Manager. A use-after-free flaw may allow an authenticated attacker to gain SYSTEM privileges. CVE-2026-0390 is a security feature bypass vulnerability in the Windows Boot Loader. Successful exploitation of the vulnerability may allow an authenticated attacker to bypass a local security feature. CVE-2026-32202 is a spoofing vulnerability in the Windows Shell. An unauthenticated attacker may exploit the vulnerability to perform network spoofing. CVE-2026-26169 is an information disclosure vulnerability in Windows Kernel Memory. An authenticated attacker may exploit the vulnerability to disclose information locally. CVE-2026-26173 is an elevation-of-privilege vulnerability in the Windows Ancillary Function Driver for WinSock. A race condition flaw may allow an authenticated attacker to gain SYSTEM privileges. CVE-2026-27909 is an elevation-of-privilege vulnerability in the Windows Search Service. A use-after-free flaw may allow an authenticated attacker to gain SYSTEM privileges. CVE-2026-27913 is a security feature bypass vulnerability in the Windows BitLocker. An improper input validation flaw may allow an unauthenticated attacker to bypass a local security feature. CVE-2026-27914 is an elevation-of-privilege vulnerability in the Microsoft Management Console. Successful exploitation of the vulnerability may allow an authenticated attacker to gain SYSTEM privileges. CVE-2026-32070 is an elevation-of-privilege vulnerability in the Windows Common Log File System Driver. A use-after-free flaw may allow an authenticated attacker to gain SYSTEM privileges. CVE-2026-32162 is an elevation-of-privilege vulnerability in Windows COM. Successful exploitation of the vulnerability may allow an unauthenticated attacker to gain SYSTEM privileges. CVE-2026-32225 is a security feature bypass vulnerability in Windows Shell. Successful exploitation of the vulnerability may allow an unauthenticated attacker to bypass a network security feature. CVE-2026-32075 is an elevation-of-privilege vulnerability in the Windows UPnP Device Host. Successful exploitation of the vulnerability may allow an authenticated attacker to gain administrator privileges.

39. Elevation of Privilege - Windows Ancillary Function Driver for WinSock (CVE-2026-26168) - High [404]

Description: Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

40. Elevation of Privilege - Windows Client Side Caching driver (csc.sys) (CVE-2026-26176) - High [404]

Description: Windows Client Side Caching driver (csc.sys) Elevation of Privilege Vulnerability

41. Elevation of Privilege - Windows Encrypted File System (EFS) (CVE-2026-26153) - High [404]

Description: Windows Encrypted File System (EFS) Elevation of Privilege Vulnerability

42. Elevation of Privilege - Windows Management Services (CVE-2026-20930) - High [404]

Description: Windows Management Services Elevation of Privilege Vulnerability

43. Elevation of Privilege - Windows Projected File System (CVE-2026-26184) - High [404]

Description: Windows Projected File System Elevation of Privilege Vulnerability

44. Elevation of Privilege - Windows Push Notifications (CVE-2026-26172) - High [404]

Description: Windows Push Notifications Elevation of Privilege Vulnerability

45. Elevation of Privilege - Windows Search Service (CVE-2026-27909) - High [404]

Description: Windows Search Service Elevation of Privilege Vulnerability

Qualys: Other Microsoft Vulnerability Highlights CVE-2026-26151 is a spoofing vulnerability in Remote Desktop. Successful exploitation of the vulnerability allows an unauthenticated attacker to perform network spoofing. CVE-2026-27906 is a security feature bypass vulnerability in Windows Hello. Successful exploitation of the vulnerability may allow an authenticated attacker to bypass a local security feature. CVE-2026-27908 is an elevation-of-privilege vulnerability in the Windows TDI Translation Driver (tdx.sys). A use-after-free flaw may allow an authenticated attacker to gain SYSTEM privileges. CVE-2026-27921 is an elevation-of-privilege vulnerability in the Windows TDI Translation Driver (tdx.sys). An attacker may exploit the vulnerability to gain SYSTEM privileges. CVE-2026-32093 is an elevation-of-privilege vulnerability in the Windows Function Discovery Service (fdwsd.dll). An authenticated attacker who successfully exploited this vulnerability could gain administrator privileges. CVE-2026-32152 and CVE-2026-32154 are elevation-of-privilege vulnerabilities in the DesktopWindow Manager. A use-after-free flaw may allow an authenticated attacker to gain SYSTEM privileges. CVE-2026-0390 is a security feature bypass vulnerability in the Windows Boot Loader. Successful exploitation of the vulnerability may allow an authenticated attacker to bypass a local security feature. CVE-2026-32202 is a spoofing vulnerability in the Windows Shell. An unauthenticated attacker may exploit the vulnerability to perform network spoofing. CVE-2026-26169 is an information disclosure vulnerability in Windows Kernel Memory. An authenticated attacker may exploit the vulnerability to disclose information locally. CVE-2026-26173 is an elevation-of-privilege vulnerability in the Windows Ancillary Function Driver for WinSock. A race condition flaw may allow an authenticated attacker to gain SYSTEM privileges. CVE-2026-27909 is an elevation-of-privilege vulnerability in the Windows Search Service. A use-after-free flaw may allow an authenticated attacker to gain SYSTEM privileges. CVE-2026-27913 is a security feature bypass vulnerability in the Windows BitLocker. An improper input validation flaw may allow an unauthenticated attacker to bypass a local security feature. CVE-2026-27914 is an elevation-of-privilege vulnerability in the Microsoft Management Console. Successful exploitation of the vulnerability may allow an authenticated attacker to gain SYSTEM privileges. CVE-2026-32070 is an elevation-of-privilege vulnerability in the Windows Common Log File System Driver. A use-after-free flaw may allow an authenticated attacker to gain SYSTEM privileges. CVE-2026-32162 is an elevation-of-privilege vulnerability in Windows COM. Successful exploitation of the vulnerability may allow an unauthenticated attacker to gain SYSTEM privileges. CVE-2026-32225 is a security feature bypass vulnerability in Windows Shell. Successful exploitation of the vulnerability may allow an unauthenticated attacker to bypass a network security feature. CVE-2026-32075 is an elevation-of-privilege vulnerability in the Windows UPnP Device Host. Successful exploitation of the vulnerability may allow an authenticated attacker to gain administrator privileges.

46. Elevation of Privilege - Windows Storage Spaces Controller (CVE-2026-27907) - High [404]

Description: Windows Storage Spaces Controller Elevation of Privilege Vulnerability

47. Elevation of Privilege - Azure Monitor Agent (CVE-2026-32192) - High [401]

Description: Azure Monitor Agent Elevation of Privilege Vulnerability

48. Elevation of Privilege - Microsoft High Performance Compute (HPC) Pack (CVE-2026-32184) - High [401]

Description: Microsoft High Performance Compute (HPC) Pack Elevation of Privilege Vulnerability

49. Security Feature Bypass - Windows Boot Manager (CVE-2026-26175) - High [401]

Description: Windows Boot Manager Security Feature Bypass Vulnerability

50. Security Feature Bypass - Windows Recovery Environment (CVE-2026-20928) - High [401]

Description: Windows Recovery Environment Security Feature Bypass Vulnerability

Medium (117)

51. Elevation of Privilege - Windows Kernel (CVE-2026-32195) - Medium [397]

Description: Windows Kernel Elevation of Privilege Vulnerability

52. Elevation of Privilege - Windows Win32k (CVE-2026-33104) - Medium [397]

Description: Win32k Elevation of Privilege Vulnerability

53. Remote Code Execution - Microsoft Excel (CVE-2026-32189) - Medium [397]

Description: Microsoft Excel Remote Code Execution Vulnerability

54. Remote Code Execution - Microsoft Excel (CVE-2026-32197) - Medium [397]

Description: Microsoft Excel Remote Code Execution Vulnerability

55. Remote Code Execution - Microsoft Excel (CVE-2026-32198) - Medium [397]

Description: Microsoft Excel Remote Code Execution Vulnerability

56. Remote Code Execution - Microsoft Excel (CVE-2026-32199) - Medium [397]

Description: Microsoft Excel Remote Code Execution Vulnerability

57. Remote Code Execution - Microsoft PowerPoint (CVE-2026-32200) - Medium [397]

Description: Microsoft PowerPoint Remote Code Execution Vulnerability

58. Remote Code Execution - Microsoft Word (CVE-2026-23657) - Medium [397]

Description: Microsoft Word Remote Code Execution Vulnerability

59. Remote Code Execution - Microsoft Word (CVE-2026-33095) - Medium [397]

Description: Microsoft Word Remote Code Execution Vulnerability

60. Remote Code Execution - Windows Hyper-V (CVE-2026-32149) - Medium [397]

Description: Windows Hyper-V Remote Code Execution Vulnerability

61. Information Disclosure - Windows Kernel (CVE-2026-32215) - Medium [393]

Description: Insertion of sensitive information into log file in Windows Kernel allows an authorized attacker to disclose information locally.

62. Information Disclosure - Windows Kernel (CVE-2026-32217) - Medium [393]

Description: Insertion of sensitive information into log file in Windows Kernel allows an authorized attacker to disclose information locally.

63. Information Disclosure - Windows Kernel (CVE-2026-32218) - Medium [393]

Description: Insertion of sensitive information into log file in Windows Kernel allows an authorized attacker to disclose information locally.

64. Elevation of Privilege - Microsoft Brokering File System (CVE-2026-32091) - Medium [392]

Description: Microsoft Brokering File System Elevation of Privilege Vulnerability

65. Elevation of Privilege - Windows Ancillary Function Driver for WinSock (CVE-2026-26173) - Medium [392]

Description: Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

Qualys: Other Microsoft Vulnerability Highlights CVE-2026-26151 is a spoofing vulnerability in Remote Desktop. Successful exploitation of the vulnerability allows an unauthenticated attacker to perform network spoofing. CVE-2026-27906 is a security feature bypass vulnerability in Windows Hello. Successful exploitation of the vulnerability may allow an authenticated attacker to bypass a local security feature. CVE-2026-27908 is an elevation-of-privilege vulnerability in the Windows TDI Translation Driver (tdx.sys). A use-after-free flaw may allow an authenticated attacker to gain SYSTEM privileges. CVE-2026-27921 is an elevation-of-privilege vulnerability in the Windows TDI Translation Driver (tdx.sys). An attacker may exploit the vulnerability to gain SYSTEM privileges. CVE-2026-32093 is an elevation-of-privilege vulnerability in the Windows Function Discovery Service (fdwsd.dll). An authenticated attacker who successfully exploited this vulnerability could gain administrator privileges. CVE-2026-32152 and CVE-2026-32154 are elevation-of-privilege vulnerabilities in the DesktopWindow Manager. A use-after-free flaw may allow an authenticated attacker to gain SYSTEM privileges. CVE-2026-0390 is a security feature bypass vulnerability in the Windows Boot Loader. Successful exploitation of the vulnerability may allow an authenticated attacker to bypass a local security feature. CVE-2026-32202 is a spoofing vulnerability in the Windows Shell. An unauthenticated attacker may exploit the vulnerability to perform network spoofing. CVE-2026-26169 is an information disclosure vulnerability in Windows Kernel Memory. An authenticated attacker may exploit the vulnerability to disclose information locally. CVE-2026-26173 is an elevation-of-privilege vulnerability in the Windows Ancillary Function Driver for WinSock. A race condition flaw may allow an authenticated attacker to gain SYSTEM privileges. CVE-2026-27909 is an elevation-of-privilege vulnerability in the Windows Search Service. A use-after-free flaw may allow an authenticated attacker to gain SYSTEM privileges. CVE-2026-27913 is a security feature bypass vulnerability in the Windows BitLocker. An improper input validation flaw may allow an unauthenticated attacker to bypass a local security feature. CVE-2026-27914 is an elevation-of-privilege vulnerability in the Microsoft Management Console. Successful exploitation of the vulnerability may allow an authenticated attacker to gain SYSTEM privileges. CVE-2026-32070 is an elevation-of-privilege vulnerability in the Windows Common Log File System Driver. A use-after-free flaw may allow an authenticated attacker to gain SYSTEM privileges. CVE-2026-32162 is an elevation-of-privilege vulnerability in Windows COM. Successful exploitation of the vulnerability may allow an unauthenticated attacker to gain SYSTEM privileges. CVE-2026-32225 is a security feature bypass vulnerability in Windows Shell. Successful exploitation of the vulnerability may allow an unauthenticated attacker to bypass a network security feature. CVE-2026-32075 is an elevation-of-privilege vulnerability in the Windows UPnP Device Host. Successful exploitation of the vulnerability may allow an authenticated attacker to gain administrator privileges.

66. Elevation of Privilege - Windows Ancillary Function Driver for WinSock (CVE-2026-26177) - Medium [392]

Description: Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

67. Elevation of Privilege - Windows Ancillary Function Driver for WinSock (CVE-2026-26182) - Medium [392]

Description: Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

68. Elevation of Privilege - Windows COM (CVE-2026-32162) - Medium [392]

Description: Windows COM Elevation of Privilege Vulnerability

Qualys: Other Microsoft Vulnerability Highlights CVE-2026-26151 is a spoofing vulnerability in Remote Desktop. Successful exploitation of the vulnerability allows an unauthenticated attacker to perform network spoofing. CVE-2026-27906 is a security feature bypass vulnerability in Windows Hello. Successful exploitation of the vulnerability may allow an authenticated attacker to bypass a local security feature. CVE-2026-27908 is an elevation-of-privilege vulnerability in the Windows TDI Translation Driver (tdx.sys). A use-after-free flaw may allow an authenticated attacker to gain SYSTEM privileges. CVE-2026-27921 is an elevation-of-privilege vulnerability in the Windows TDI Translation Driver (tdx.sys). An attacker may exploit the vulnerability to gain SYSTEM privileges. CVE-2026-32093 is an elevation-of-privilege vulnerability in the Windows Function Discovery Service (fdwsd.dll). An authenticated attacker who successfully exploited this vulnerability could gain administrator privileges. CVE-2026-32152 and CVE-2026-32154 are elevation-of-privilege vulnerabilities in the DesktopWindow Manager. A use-after-free flaw may allow an authenticated attacker to gain SYSTEM privileges. CVE-2026-0390 is a security feature bypass vulnerability in the Windows Boot Loader. Successful exploitation of the vulnerability may allow an authenticated attacker to bypass a local security feature. CVE-2026-32202 is a spoofing vulnerability in the Windows Shell. An unauthenticated attacker may exploit the vulnerability to perform network spoofing. CVE-2026-26169 is an information disclosure vulnerability in Windows Kernel Memory. An authenticated attacker may exploit the vulnerability to disclose information locally. CVE-2026-26173 is an elevation-of-privilege vulnerability in the Windows Ancillary Function Driver for WinSock. A race condition flaw may allow an authenticated attacker to gain SYSTEM privileges. CVE-2026-27909 is an elevation-of-privilege vulnerability in the Windows Search Service. A use-after-free flaw may allow an authenticated attacker to gain SYSTEM privileges. CVE-2026-27913 is a security feature bypass vulnerability in the Windows BitLocker. An improper input validation flaw may allow an unauthenticated attacker to bypass a local security feature. CVE-2026-27914 is an elevation-of-privilege vulnerability in the Microsoft Management Console. Successful exploitation of the vulnerability may allow an authenticated attacker to gain SYSTEM privileges. CVE-2026-32070 is an elevation-of-privilege vulnerability in the Windows Common Log File System Driver. A use-after-free flaw may allow an authenticated attacker to gain SYSTEM privileges. CVE-2026-32162 is an elevation-of-privilege vulnerability in Windows COM. Successful exploitation of the vulnerability may allow an unauthenticated attacker to gain SYSTEM privileges. CVE-2026-32225 is a security feature bypass vulnerability in Windows Shell. Successful exploitation of the vulnerability may allow an unauthenticated attacker to bypass a network security feature. CVE-2026-32075 is an elevation-of-privilege vulnerability in the Windows UPnP Device Host. Successful exploitation of the vulnerability may allow an authenticated attacker to gain administrator privileges.

69. Elevation of Privilege - Windows Function Discovery Service (fdwsd.dll) (CVE-2026-32093) - Medium [392]

Description: Windows Function Discovery Service (fdwsd.dll) Elevation of Privilege Vulnerability

Qualys: Other Microsoft Vulnerability Highlights CVE-2026-26151 is a spoofing vulnerability in Remote Desktop. Successful exploitation of the vulnerability allows an unauthenticated attacker to perform network spoofing. CVE-2026-27906 is a security feature bypass vulnerability in Windows Hello. Successful exploitation of the vulnerability may allow an authenticated attacker to bypass a local security feature. CVE-2026-27908 is an elevation-of-privilege vulnerability in the Windows TDI Translation Driver (tdx.sys). A use-after-free flaw may allow an authenticated attacker to gain SYSTEM privileges. CVE-2026-27921 is an elevation-of-privilege vulnerability in the Windows TDI Translation Driver (tdx.sys). An attacker may exploit the vulnerability to gain SYSTEM privileges. CVE-2026-32093 is an elevation-of-privilege vulnerability in the Windows Function Discovery Service (fdwsd.dll). An authenticated attacker who successfully exploited this vulnerability could gain administrator privileges. CVE-2026-32152 and CVE-2026-32154 are elevation-of-privilege vulnerabilities in the DesktopWindow Manager. A use-after-free flaw may allow an authenticated attacker to gain SYSTEM privileges. CVE-2026-0390 is a security feature bypass vulnerability in the Windows Boot Loader. Successful exploitation of the vulnerability may allow an authenticated attacker to bypass a local security feature. CVE-2026-32202 is a spoofing vulnerability in the Windows Shell. An unauthenticated attacker may exploit the vulnerability to perform network spoofing. CVE-2026-26169 is an information disclosure vulnerability in Windows Kernel Memory. An authenticated attacker may exploit the vulnerability to disclose information locally. CVE-2026-26173 is an elevation-of-privilege vulnerability in the Windows Ancillary Function Driver for WinSock. A race condition flaw may allow an authenticated attacker to gain SYSTEM privileges. CVE-2026-27909 is an elevation-of-privilege vulnerability in the Windows Search Service. A use-after-free flaw may allow an authenticated attacker to gain SYSTEM privileges. CVE-2026-27913 is a security feature bypass vulnerability in the Windows BitLocker. An improper input validation flaw may allow an unauthenticated attacker to bypass a local security feature. CVE-2026-27914 is an elevation-of-privilege vulnerability in the Microsoft Management Console. Successful exploitation of the vulnerability may allow an authenticated attacker to gain SYSTEM privileges. CVE-2026-32070 is an elevation-of-privilege vulnerability in the Windows Common Log File System Driver. A use-after-free flaw may allow an authenticated attacker to gain SYSTEM privileges. CVE-2026-32162 is an elevation-of-privilege vulnerability in Windows COM. Successful exploitation of the vulnerability may allow an unauthenticated attacker to gain SYSTEM privileges. CVE-2026-32225 is a security feature bypass vulnerability in Windows Shell. Successful exploitation of the vulnerability may allow an unauthenticated attacker to bypass a network security feature. CVE-2026-32075 is an elevation-of-privilege vulnerability in the Windows UPnP Device Host. Successful exploitation of the vulnerability may allow an authenticated attacker to gain administrator privileges.

70. Elevation of Privilege - Windows Installer (CVE-2026-27910) - Medium [392]

Description: Windows Installer Elevation of Privilege Vulnerability

71. Elevation of Privilege - Windows Print Spooler (CVE-2026-33101) - Medium [392]

Description: Windows Print Spooler Elevation of Privilege Vulnerability

72. Elevation of Privilege - Windows Projected File System (CVE-2026-27927) - Medium [392]

Description: Windows Projected File System Elevation of Privilege Vulnerability

73. Elevation of Privilege - Windows Projected File System (CVE-2026-32069) - Medium [392]

Description: Windows Projected File System Elevation of Privilege Vulnerability

74. Elevation of Privilege - Windows Projected File System (CVE-2026-32074) - Medium [392]

Description: Windows Projected File System Elevation of Privilege Vulnerability

75. Elevation of Privilege - Windows Projected File System (CVE-2026-32078) - Medium [392]

Description: Windows Projected File System Elevation of Privilege Vulnerability

76. Elevation of Privilege - Windows Push Notifications (CVE-2026-32158) - Medium [392]

Description: Windows Push Notifications Elevation of Privilege Vulnerability

77. Elevation of Privilege - Windows Push Notifications (CVE-2026-32159) - Medium [392]

Description: Windows Push Notifications Elevation of Privilege Vulnerability

78. Elevation of Privilege - Windows Push Notifications (CVE-2026-32160) - Medium [392]

Description: Windows Push Notifications Elevation of Privilege Vulnerability

79. Elevation of Privilege - Windows Server Update Service (WSUS) (CVE-2026-26174) - Medium [392]

Description: Windows Server Update Service (WSUS) Elevation of Privilege Vulnerability

80. Elevation of Privilege - Windows Shell (CVE-2026-26165) - Medium [392]

Description: Windows Shell Elevation of Privilege Vulnerability

81. Elevation of Privilege - Windows Shell (CVE-2026-26166) - Medium [392]

Description: Windows Shell Elevation of Privilege Vulnerability

82. Elevation of Privilege - Windows Shell (CVE-2026-27918) - Medium [392]

Description: Windows Shell Elevation of Privilege Vulnerability

83. Elevation of Privilege - Windows Speech Brokered Api (CVE-2026-32089) - Medium [392]

Description: Windows Speech Brokered Api Elevation of Privilege Vulnerability

84. Elevation of Privilege - Windows Speech Brokered Api (CVE-2026-32090) - Medium [392]

Description: Windows Speech Brokered Api Elevation of Privilege Vulnerability

85. Elevation of Privilege - Windows Speech Runtime (CVE-2026-32153) - Medium [392]

Description: Windows Speech Runtime Elevation of Privilege Vulnerability

86. Elevation of Privilege - Windows Storage Spaces Controller (CVE-2026-32076) - Medium [392]

Description: Windows Storage Spaces Controller Elevation of Privilege Vulnerability

87. Elevation of Privilege - Windows TDI Translation Driver (tdx.sys) (CVE-2026-27908) - Medium [392]

Description: Windows TDI Translation Driver (tdx.sys) Elevation of Privilege Vulnerability

Qualys: Other Microsoft Vulnerability Highlights CVE-2026-26151 is a spoofing vulnerability in Remote Desktop. Successful exploitation of the vulnerability allows an unauthenticated attacker to perform network spoofing. CVE-2026-27906 is a security feature bypass vulnerability in Windows Hello. Successful exploitation of the vulnerability may allow an authenticated attacker to bypass a local security feature. CVE-2026-27908 is an elevation-of-privilege vulnerability in the Windows TDI Translation Driver (tdx.sys). A use-after-free flaw may allow an authenticated attacker to gain SYSTEM privileges. CVE-2026-27921 is an elevation-of-privilege vulnerability in the Windows TDI Translation Driver (tdx.sys). An attacker may exploit the vulnerability to gain SYSTEM privileges. CVE-2026-32093 is an elevation-of-privilege vulnerability in the Windows Function Discovery Service (fdwsd.dll). An authenticated attacker who successfully exploited this vulnerability could gain administrator privileges. CVE-2026-32152 and CVE-2026-32154 are elevation-of-privilege vulnerabilities in the DesktopWindow Manager. A use-after-free flaw may allow an authenticated attacker to gain SYSTEM privileges. CVE-2026-0390 is a security feature bypass vulnerability in the Windows Boot Loader. Successful exploitation of the vulnerability may allow an authenticated attacker to bypass a local security feature. CVE-2026-32202 is a spoofing vulnerability in the Windows Shell. An unauthenticated attacker may exploit the vulnerability to perform network spoofing. CVE-2026-26169 is an information disclosure vulnerability in Windows Kernel Memory. An authenticated attacker may exploit the vulnerability to disclose information locally. CVE-2026-26173 is an elevation-of-privilege vulnerability in the Windows Ancillary Function Driver for WinSock. A race condition flaw may allow an authenticated attacker to gain SYSTEM privileges. CVE-2026-27909 is an elevation-of-privilege vulnerability in the Windows Search Service. A use-after-free flaw may allow an authenticated attacker to gain SYSTEM privileges. CVE-2026-27913 is a security feature bypass vulnerability in the Windows BitLocker. An improper input validation flaw may allow an unauthenticated attacker to bypass a local security feature. CVE-2026-27914 is an elevation-of-privilege vulnerability in the Microsoft Management Console. Successful exploitation of the vulnerability may allow an authenticated attacker to gain SYSTEM privileges. CVE-2026-32070 is an elevation-of-privilege vulnerability in the Windows Common Log File System Driver. A use-after-free flaw may allow an authenticated attacker to gain SYSTEM privileges. CVE-2026-32162 is an elevation-of-privilege vulnerability in Windows COM. Successful exploitation of the vulnerability may allow an unauthenticated attacker to gain SYSTEM privileges. CVE-2026-32225 is a security feature bypass vulnerability in Windows Shell. Successful exploitation of the vulnerability may allow an unauthenticated attacker to bypass a network security feature. CVE-2026-32075 is an elevation-of-privilege vulnerability in the Windows UPnP Device Host. Successful exploitation of the vulnerability may allow an authenticated attacker to gain administrator privileges.

88. Elevation of Privilege - Windows TDI Translation Driver (tdx.sys) (CVE-2026-27921) - Medium [392]

Description: Windows TDI Translation Driver (tdx.sys) Elevation of Privilege Vulnerability

Qualys: Other Microsoft Vulnerability Highlights CVE-2026-26151 is a spoofing vulnerability in Remote Desktop. Successful exploitation of the vulnerability allows an unauthenticated attacker to perform network spoofing. CVE-2026-27906 is a security feature bypass vulnerability in Windows Hello. Successful exploitation of the vulnerability may allow an authenticated attacker to bypass a local security feature. CVE-2026-27908 is an elevation-of-privilege vulnerability in the Windows TDI Translation Driver (tdx.sys). A use-after-free flaw may allow an authenticated attacker to gain SYSTEM privileges. CVE-2026-27921 is an elevation-of-privilege vulnerability in the Windows TDI Translation Driver (tdx.sys). An attacker may exploit the vulnerability to gain SYSTEM privileges. CVE-2026-32093 is an elevation-of-privilege vulnerability in the Windows Function Discovery Service (fdwsd.dll). An authenticated attacker who successfully exploited this vulnerability could gain administrator privileges. CVE-2026-32152 and CVE-2026-32154 are elevation-of-privilege vulnerabilities in the DesktopWindow Manager. A use-after-free flaw may allow an authenticated attacker to gain SYSTEM privileges. CVE-2026-0390 is a security feature bypass vulnerability in the Windows Boot Loader. Successful exploitation of the vulnerability may allow an authenticated attacker to bypass a local security feature. CVE-2026-32202 is a spoofing vulnerability in the Windows Shell. An unauthenticated attacker may exploit the vulnerability to perform network spoofing. CVE-2026-26169 is an information disclosure vulnerability in Windows Kernel Memory. An authenticated attacker may exploit the vulnerability to disclose information locally. CVE-2026-26173 is an elevation-of-privilege vulnerability in the Windows Ancillary Function Driver for WinSock. A race condition flaw may allow an authenticated attacker to gain SYSTEM privileges. CVE-2026-27909 is an elevation-of-privilege vulnerability in the Windows Search Service. A use-after-free flaw may allow an authenticated attacker to gain SYSTEM privileges. CVE-2026-27913 is a security feature bypass vulnerability in the Windows BitLocker. An improper input validation flaw may allow an unauthenticated attacker to bypass a local security feature. CVE-2026-27914 is an elevation-of-privilege vulnerability in the Microsoft Management Console. Successful exploitation of the vulnerability may allow an authenticated attacker to gain SYSTEM privileges. CVE-2026-32070 is an elevation-of-privilege vulnerability in the Windows Common Log File System Driver. A use-after-free flaw may allow an authenticated attacker to gain SYSTEM privileges. CVE-2026-32162 is an elevation-of-privilege vulnerability in Windows COM. Successful exploitation of the vulnerability may allow an unauthenticated attacker to gain SYSTEM privileges. CVE-2026-32225 is a security feature bypass vulnerability in Windows Shell. Successful exploitation of the vulnerability may allow an unauthenticated attacker to bypass a network security feature. CVE-2026-32075 is an elevation-of-privilege vulnerability in the Windows UPnP Device Host. Successful exploitation of the vulnerability may allow an authenticated attacker to gain administrator privileges.

89. Elevation of Privilege - Windows UPnP Device Host (CVE-2026-27915) - Medium [392]

Description: Windows UPnP Device Host Elevation of Privilege Vulnerability

90. Elevation of Privilege - Windows UPnP Device Host (CVE-2026-27916) - Medium [392]

Description: Windows UPnP Device Host Elevation of Privilege Vulnerability

91. Elevation of Privilege - Windows UPnP Device Host (CVE-2026-27919) - Medium [392]

Description: Windows UPnP Device Host Elevation of Privilege Vulnerability

92. Elevation of Privilege - Windows UPnP Device Host (CVE-2026-27920) - Medium [392]

Description: Windows UPnP Device Host Elevation of Privilege Vulnerability

93. Elevation of Privilege - Windows UPnP Device Host (CVE-2026-32077) - Medium [392]

Description: Windows UPnP Device Host Elevation of Privilege Vulnerability

94. Elevation of Privilege - Windows USB Printing Stack (usbprint.sys) (CVE-2026-32223) - Medium [392]

Description: Windows USB Printing Stack (usbprint.sys) Elevation of Privilege Vulnerability

95. Elevation of Privilege - Windows User Interface Core (CVE-2026-27911) - Medium [392]

Description: Windows User Interface Core Elevation of Privilege Vulnerability

96. Elevation of Privilege - Windows User Interface Core (CVE-2026-32163) - Medium [392]

Description: Windows User Interface Core Elevation of Privilege Vulnerability

97. Elevation of Privilege - Windows User Interface Core (CVE-2026-32164) - Medium [392]

Description: Windows User Interface Core Elevation of Privilege Vulnerability

98. Elevation of Privilege - Windows User Interface Core (CVE-2026-32165) - Medium [392]

Description: Windows User Interface Core Elevation of Privilege Vulnerability