​​​​​​​​What’s new in Microsoft Security: September 2026​​

AI agents are now running on employee devices, cloud platforms, and across developer workflows. Security teams need to see those agents, govern what they can reach, and contain them when something goes wrong. This month's updates help you discover and control local AI agents, extend Zero Trust to...

CVE-2026-69554

creationtimestamp| type| source ---|---|--- 2026-09-08 22:03:43+00:00| seen| https://www.thezdi.com/blog/2026/9/8/the-september-2026-security-update-review 2026-09-09 04:03:36+00:00| seen| https://www.thezdi.com/blog/2026/9/8/the-september-2026-security-update-review 2026-09-09 09:17:13+00:00|...

CVE-2026-72936

creationtimestamp| type| source ---|---|--- 2026-09-08 22:00:59+00:00| seen| https://www.thezdi.com/blog/2026/9/8/the-september-2026-security-update-review 2026-09-09 04:00:54+00:00| seen| https://www.thezdi.com/blog/2026/9/8/the-september-2026-security-update-review 2026-09-09 10:20:37+00:00|...

​​​​​​What’s new in Microsoft Security: August 2026

As organizations incorporate AI agents into more processes across business and operations, security teams can benefit from greater visibility and new purpose-built tools that help manage, secure, and govern AI. This month’s updates provide new capabilities to help organizations gain insights into...

CVE-2026-62834 Azure Data Factory Elevation of Privilege Vulnerability

...

Lack of transparency in the Microsoft Power BI server

Microsoft has identified a vulnerability in the Power BI server. A malicious individual could exploit this vulnerability to execute arbitrary code on the server. For successful exploitation, the malicious individual must have access to prior authentication. Microsoft has provided updates that...

CVE-2026-70321

creationtimestamp| type| source ---|---|--- 2026-08-11 19:01:16+00:00| seen| https://www.thezdi.com/blog/2026/8/11/the-august-2026-security-update-review 2026-08-11 22:01:23+00:00| seen| https://advisories.ncsc.nl/advisory?id=NCSC-2026-0286 2026-08-12 01:01:12+00:00| seen|...

CVE-2026-68800

creationtimestamp| type| source ---|---|--- 2026-08-11 19:01:03+00:00| seen| https://www.thezdi.com/blog/2026/8/11/the-august-2026-security-update-review 2026-08-11 22:01:20+00:00| seen| https://advisories.ncsc.nl/advisory?id=NCSC-2026-0286 2026-08-12 01:00:59+00:00| seen|...

2026-08 Dynamic Cumulative Update for Windows 10 Version 21H2 for x86-based Systems (KB5120249)

ComponentUpdate: A security issue has been identified in a Microsoft software product that could affect your system. You can help protect your system by installing this update from Microsoft. For a complete listing of the issues that are included in this update, see the associated Microsoft...

2026-08 Cumulative Update for .NET Framework 3.5, 4.7.2 and 4.8 for Windows 10 Version 1809 for x64 (KB5121645)

A security issue has been identified in a Microsoft software product that could affect your system. You can help protect your system by installing this update from Microsoft. For a complete listing of the issues that are included in this update, see the associated Microsoft Knowledge Base article...

Exploit for Race Condition in Microsoft

When ValidateHwnd Isn't a Gate: Root-Causing CVE-2026-54107...

Congratulations to the top MSRC 2026 Q2 security researchers!

Congratulations to the researchers recognized in the MSRC 2026 Q2 Security Researcher Leaderboard. This quarter marks the final quarterly points-based leaderboard as we transition to our updated researcher recognition program. We are grateful for the contributions of the security research communi...

PT-2026-60211

Microsoft AVML before 0.17.0 could follow a symlink when opening a destination output path on Unix, allowing truncation/overwrite of the symlink target. The destructive effect is performed at open-time via O TRUNC, and can happen before full input validation completes “truncation-before-validatio...

CVE-2026-57097 Microsoft XML Security Feature Bypass Vulnerability

...

New Forrester Total Economic Impact™ study projects a 124% ROI from unifying with Microsoft Security

Across many industries, organizations are unifying security and putting AI agents to work. Security teams are utilizing agents that reason, decide, and act on their behalf, under their governance. At Microsoft, we see this firsthand—more than 80% of the Fortune 500 are already using AI.1 The...

Defense at AI speed: Microsoft’s new multi-model agentic security system tops leading industry benchmark

In this article 1. AI-powered vulnerability discovery at hyper-scale 2. Codename: MDASH—Microsoft Security’s new multi-model agentic scanning harness 3. Using codename MDASH for security research 4. The 5.12.2026 Patch Tuesday cohort 5. Two deep dives 1. CVE-2026-33827—Remote unauthenticated UAF ...

Agentic Vulnerability Reasoning on Windows COM Binaries

Windows Component Object Model COM services run with elevated privileges and are widely accessible to authenticated users, making race conditions in these binaries a critical surface for local privilege escalation. We present SLYP, an end-to-end agentic pipeline that discovers race condition...

AI-powered defense for an AI-accelerated threat landscape

We are at an inflection point in cybersecurity. Recent advances in AI model capabilities are changing how vulnerabilities are discovered and exploited. AI models can autonomously discover weaknesses, chain multiple lower-severity issues into working end-to-end exploits, and produce working...

Secure agentic AI end-to-end

Next week, RSAC™ Conference celebrates its 35-year anniversary as a forum that brings the security community together to address new challenges and embrace opportunities in our quest to make the world a safer place for all. As we look towards that milestone, agentic AI is reshaping industries...

New e-book: Establishing a proactive defense with Microsoft Security Exposure Management

Effective exposure management begins by illuminating and hardening risks across the entire attack surface. Some of the most meaningful shifts in security happen quietly—when teams take a clear look at their exposure landscape and acknowledge the gap between where they stand today and where they...