CVE-2026-88147

A heap-based buffer overflow exists in the Windows Secure Socket Tunneling Protocol (SSTP) . This vulnerability allows an authorized attacker to perform a local privilege escalation . The impact includes high levels of confidentiality, integrity, and availability loss as reported in the CVSS metr...

EUVD-2026-99787

Exposure of sensitive system information to an unauthorized control sphere in Windows Secure Kernel Mode allows an authorized attacker to disclose information locally...

CVE-2026-96865

A vulnerability in Windows Secure Kernel Mode allows an authorized attacker to disclose sensitive system information locally. This issue is characterized by the exposure of information to an unauthorized control sphere (CWE-497). The vulnerability has a CVSS 3.1 base score of 5.6 (Medium) with a ...

CVE-2026-85926

A Use after free vulnerability exists in the Windows Secure Socket Tunneling Protocol (SSTP) . This flaw allows an unauthorized attacker to achieve remote code execution over a network. The CVSS 3.1 score is 8.1 (High) , with high impact across confidentiality, integrity, and availability. Docume...

EUVD-2026-99626

Use after free in Windows Secure Socket Tunneling Protocol SSTP allows an unauthorized attacker to execute code over a network...

EUVD-2026-99134

Access of resource using incompatible type 'type confusion' in Windows Secure Kernel Mode allows an authorized attacker to disclose information locally...

CVE-2026-70017

A type confusion vulnerability exists in Windows Secure Kernel Mode , where accessing a resource using an incompatible type allows an authorized attacker to perform a local information disclosure . The vulnerability is assigned CWE-843 . No specific patch versions, exploit links, or additional te...

CVE-2026-70026

A Use after free vulnerability exists in Windows Secure Kernel Mode , which could allow an authorized attacker to achieve local privilege escalation . Technical details regarding the specific component or root cause are not provided in the documents. No exploits or in-the-wild exploitation inform...

EUVD-2026-99137

Use after free in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally...

Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access, Only Two Patched So Far

An attacker chained three zero-day flaws in Ivanti Connect Secure, a VPN appliance, to run commands as root without logging in, security firm Volexity said on October 13. Ivanti has released fixes for two of the flaws and told customers on affected versions to "act immediately." A fix for the thi...

Ivanti Connect Secure zero-day exploited in the wild (CVE-2026-104935)

Overview On October 13, 2026, Ivanti published a security advisory for CVE-2026-104935, a high-severity authentication bypass by spoofing CWE-290 affecting Ivanti Connect Secure ICS. The vulnerability has a CVSSv3.0 score of 8.6 and allows a remote, unauthenticated attacker to execute arbitrary...

September 8, 2026—KB5123099 (OS Build 14393.9512)

September 8, 2026—KB5123099 OS Build 14393.9512 Applies To Windows Server 2016, all editions Win 10 Ent LTSB 2016 Win 10 IoT Ent LTSB 2016 Important Free support for Windows 10 Enterprise 2016 LTSB and Windows Server 2016 will soon end. For information about the availability of Extended Security...

September 8, 2026—KB5122878 (OS Builds 19045.7725 and 19044.7725)

September 8, 2026—KB5122878 OS Builds 19045.7725 and 19044.7725 Applies To Windows 10 ESU Windows 10 Enterprise LTSC 2021 Windows 10 IoT Enterprise LTSC 2021 Important Free support for Windows 10 Enterprise LTSC 2021 will end soon. For information about the availability of an Extended Security...

September 8, 2026—KB5122876 (OS Build 17763.9245)

September 8, 2026—KB5122876 OS Build 17763.9245 Applies To Windows Server 2019 Win 10 Ent LTSC 2019 Summary This article lists the security issues and quality improvements included in this cumulative security update. Windows Server 2019 Windows 10, version 1809 Applies to: Windows Server 2019 Thi...

October 13, 2026—KB5127646 (OS Build 28000.3231)

October 13, 2026—KB5127646 OS Build 28000.3231 Applies To Windows 11 version 26H1, all editions This cumulative update for Windows 11, version 26H1 KB5127646 includes the latest security fixes and improvements, along with non-security updates from last month's optional preview release. Visit the...

Windows Secure Kernel Mode Information Disclosure Vulnerability

Access of resource using incompatible type 'type confusion' in Windows Secure Kernel Mode allows an authorized attacker to disclose information locally...

Secure Boot Security Feature Bypass Vulnerability

No cwe for this issue in Windows Secure Boot allows an authorized attacker to bypass a security feature locally...

September 8, 2026—KB5123065 (Monthly Rollup)

September 8, 2026—KB5123065 Monthly Rollup Applies To Windows Server 2012 ESU Important The installation of this Extended Security Update ESU might fail when you try to install it on an Azure Arc-enabled device that is running Windows Server 2012. For a successful installation, please make sure a...

Windows Secure Kernel Mode Information Disclosure Vulnerability

Exposure of sensitive system information to an unauthorized control sphere in Windows Secure Kernel Mode allows an authorized attacker to disclose information locally...

Windows Secure Socket Tunneling Protocol (SSTP) Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Secure Socket Tunneling Protocol SSTP allows an authorized attacker to elevate privileges locally...