CVE-2026-0386 Windows Deployment Services Remote Code Execution Vulnerability

...

CVE-2026-0386

CVE-2026-0386 : Windows Deployment Services has an improper access control vulnerability that can allow an adjacent-network attacker to execute code remotely. This entry is supported by multiple sources confirming the issue and indicating Microsoft has released January 2026 security updates to ad...

January 13, 2026—KB5073697 (Monthly Rollup)

None None...

January 13, 2026—KB5073699 (Security-only update)

None None...

January 13, 2026—KB5073722 (OS Build 14393.8783)

None None...

January 13, 2026—KB5073700 (Security-only update)

None None...

January 13, 2026—KB5073723 (OS Build 17763.8276)

None None...

Windows Deployment Services Remote Code Execution Vulnerability

Improper access control in Windows Deployment Services allows an unauthorized attacker to execute code over an adjacent network...

Microsoft Windows Admin Center 数据伪造问题漏洞

Microsoft Windows Admin Center is a locally deployed browser-based application from Microsoft USA. The program is primarily used to manage servers, clusters, and more. Microsoft Windows Admin Center is vulnerable to a data forgery issue. An attacker can exploit this vulnerability to elevate...

Microsoft Windows Deployment Services 访问控制错误漏洞

Microsoft Windows Deployment Services is a setup container for Microsoft's Windows Deployment Services, an updated and redesigned version of Remote Installation Services RIS, that can be used to set up new computers via unattended network-based installations. An access control error vulnerability...

Microsoft Office 代码问题漏洞

Microsoft Office is an office software suite of products from the U.S. company Microsoft Microsoft. Commonly used components of this product include Word, Excel, Access, Powerpoint, FrontPage, and others. A code issue vulnerability exists in Microsoft Office. An attacker exploiting this...

aiptx-cyber-mcp

Cyber MCPs - Security Tools for AI !MCP Securityhttps://...

A High-Recall Cost-Sensitive Machine Learning Framework for Real-Time Online Banking Transaction Fraud Detection

Fraudulent activities on digital banking services are becoming more intricate by the day, challenging existing defenses. While older rule driven methods struggle to keep pace, even precision focused algorithms fall short when new scams are introduced. These tools typically overlook subtle shifts ...

EUVD-2025-206271

Details On October 1, 2025, Palantir discovered that images uploaded through the Dossier front-end app were not being marked correctly with the proper security levels. The regression was traced back to a change in May 2025, which was meant to allow file uploads to be shared among different...

QES-Backed Virtual FIDO2 Authenticators: Architectural Options for Secure, Synchronizable WebAuthn Credentials

FIDO2 and the WebAuthn standard offer phishing-resistant, public-key based authentication but traditionally rely on device-bound cryptographic keys that are not naturally portable across user devices. Recent passkey deployments address this limitation by enabling multi-device credentials...

CVE-2023-45085

An issue exists in SoftIron HyperCloud where compute nodes may come online immediately without following the correct initialization process. In this instance, workloads may be scheduled on these nodes and deploy to a failed or erroneous state, which impacts the availability of these workloads tha...

CVE-2022-23716

A flaw was discovered in ECE before 3.1.1 that could lead to the disclosure of the SAML signing private key used for the RBAC features, in deployment logs in the Logging and Monitoring cluster...

CVE-2020-10962

In PowerShell App Deployment Toolkit aka PSAppDeployToolkit through 3.8.0, an incorrect access control vulnerability in the default configuration may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2022-31028

MinIO is a multi-cloud object storage solution. Starting with version RELEASE.2019-09-25T18-25-51Z and ending with version RELEASE.2022-06-02T02-11-04Z, MinIO is vulnerable to an unending go-routine buildup while keeping connections established due to HTTP clients not closing the connections...

CVE-2025-14887

The twinklesmtp – Email Service Provider For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin's sender settings in all versions up to, and including, 1.03 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...