{"metadata": {"vulnerability": "CVE-2026-124194", "count": 190, "kinds": {"milestone": 8, "sighting": 154, "kev": 11, "other": 17}, "linked_omitted": 0}, "data": [{"timestamp": "2026-11-06T22:09:21.493Z", "date_only": false, "value": "2026-11-06T22:09:21.493Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-124194", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-09T00:00:00Z", "date_only": false, "value": "2026-11-09T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-124194", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-11-09T00:00:00Z", "date_only": false, "value": "2026-11-09T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-124194", "record": "FKIE_CVE-2026-124194", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2026-11-10T00:00:00Z", "date_only": false, "value": "2026-11-10T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2026-124194", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "18197b96-abfb-460f-bfda-3ddc05096729", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-11-10T00:00:00Z", "date_only": true, "value": "2026-11-10", "kind": "other", "label": "Catalog added", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-124194", "field": "containers.adp.0.metrics.1.other.content.dateAdded"}, {"timestamp": "2026-11-10T00:00:00Z", "date_only": true, "value": "2026-11-10", "kind": "kev", "label": "Date added", "source": "cisa-kev", "record": "CVE-2026-124194", "field": "evidence.0.details.date_added", "uuid": "18197b96-abfb-460f-bfda-3ddc05096729", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-11-10T00:00:00Z", "date_only": false, "value": "2026-11-10T00:00:00+00:00", "kind": "kev", "label": "First seen", "source": "cisa-kev", "record": "CVE-2026-124194", "field": "timestamps.first_seen_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "18197b96-abfb-460f-bfda-3ddc05096729", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-11-10T00:00:00Z", "date_only": true, "value": "2026-11-10", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1511", "record": "CERTFR-2026-AVI-1511", "field": "vendor_advisories.0.published_at", "linked_record": true}, {"timestamp": "2026-11-10T00:00:00Z", "date_only": false, "value": "2026-11-10T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "cisa-kev", "record": "CVE-2026-124194", "field": "status.status_updated_at", "uuid": "18197b96-abfb-460f-bfda-3ddc05096729", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-11-10T00:00:00Z", "date_only": false, "value": "2026-11-10T00:00:00.000Z", "kind": "other", "label": "Timeline", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-124194", "field": "containers.adp.0.timeline.0.time", "text": "CVE-2026-124194 added to CISA KEV"}, {"timestamp": "2026-11-10T08:00:00Z", "date_only": false, "value": "2026-11-10T08:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "previdian", "record": "CVE-2026-124194", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "9d6c1725-27e8-4c4e-9004-e9499278552a", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-11-10T08:00:00Z", "date_only": false, "value": "2026-11-10T08:00:00.000Z", "kind": "kev", "label": "Catalog added", "source": "previdian", "record": "CVE-2026-124194", "field": "evidence.0.details.added_date", "uuid": "9d6c1725-27e8-4c4e-9004-e9499278552a", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-11-10T08:00:00Z", "date_only": false, "value": "2026-11-10T08:00:00+00:00", "kind": "kev", "label": "First seen", "source": "previdian", "record": "CVE-2026-124194", "field": "timestamps.first_seen_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "9d6c1725-27e8-4c4e-9004-e9499278552a", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-11-10T08:00:00Z", "date_only": false, "value": "2026-11-10T08:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "previdian", "record": "CVE-2026-124194", "field": "status.status_updated_at", "uuid": "9d6c1725-27e8-4c4e-9004-e9499278552a", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-11-10T12:46:26Z", "date_only": false, "value": "2026-11-10T12:46:26.000000Z", "kind": "sighting", "label": "Seen", "source": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0474", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "09b0cc00-474e-4f20-8644-814678298c9c", "url": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0474"}, {"timestamp": "2026-11-10T16:00:00Z", "date_only": false, "value": "2026-11-10T16:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / microsoft", "record": "CVE-2026-124194", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-10T18:02:41Z", "date_only": false, "value": "2026-11-10T18:02:41.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.thezdi.com/blog/2026/11/10/the-november-2026-security-update-review", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "1937cd68-7a77-4574-9d73-6f3c90eeac1f", "content": "The penultimate month of 2026 bring with it the usual storm of patches from Microsoft and Adobe. I\u2019ve been prototyping some new ways to display this data, but as always, I\u2019m open to suggestions. Seriously \u2013 hit me up on Bluesky if you have any ideas. If you\u2019d rather watch the full video recap covering the entire release, you can check out the Patch Report webcast on our YouTube channel. It should be posted within a couple of hours after the release.\nAdobe Patches for November 2026\nFor the first part of the November release, Adobe released nine bulletins addressing 110 unique CVEs in Adobe Connect, Experience Manager, After Effects, Audition, Dimension, Photoshop, Media Encoder, Premiere, and Content Credentials SDK.\nHere\u2019s this month\u2019s overview table:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n    \n\nAdobe Patches for November 2026\n\n\nBulletin IDProductCVE CountHighest SeverityHighest CVSSExploitedDeployment Priority\n\nAPSB26-191Adobe Connect24Critical10.0No2\nAPSB26-189Adobe Experience Manager14Critical9.9No2\nAPSB26-102Adobe Audition11High8.7No3\nAPSB26-100Adobe After Effects17High8.6No3\nAPSB26-190Adobe Dimension1High8.2No3\nAPSB26-181Adobe Photoshop13High7.8No3\nAPSB26-101Adobe Premiere11High7.8No3\nAPSB26-103Adobe Media Encoder6High7.8No3\nAPSB26-184Content Credentials SDK13Medium6.5No3\nTOTAL9 bulletins110\n\n\n\n  \n  \n\n\n\n\n\n\n\n\n\n\n  \nObviously, if you need to prioritize, the Connect patch is the biggest and most severe bulletin this month: 24 CVEs, 18 of them Critical, with a top CVSS of 10.0. It\u2019s Priority 2, and Adobe is not aware of any exploits in the wild. Each of the CVSS10 bugs are reachable over the network with no authentication or user interaction, and each changes scope. The other Critical-rated update for this month is in Experience Manager. It addresses 14 CVEs, which includes four Critical bugs with a CVSS 9.9 rating. Two are incorrect-authorization bugs and two are code injections. All give arbitrary code execution over the network. Each needs a low-privileged account but no user interaction, and each changes scope.\nBesides the bugs already mentioned, all other patched from Adobe are a Deployment Priority 3. None of the other Adobe bugs receiving patches this month are listed as publicly known or under active attack at the time of release.\nMicrosoft Patches for November 2026\nWell, at least it\u2019s not a new record for Microsoft. As always, the overall count is a bit confusing, but I see about 1,090 new CVEs released today. At this point, does the exact number actually matter? Regardless of the actual count, it\u2019s huge but less than the 1,400 or so released last month. That\u2019s two months in a row that have exceeded all previous years from Microsoft. As for the products affected by this release, we have Windows and Windows components; Office and Office Components; Windows networking and remote access; Windows graphics, media and printing; Windows storage file systems and drivers; .NET and Visual Studio; Windows Security and identity; Azure, cloud and identity; Exchange Server; Microsoft Dynamics; and Xbox. We\u2019ll see how close I came to matching Microsoft\u2019s \u201cCohorts\u201d list.\n Interestingly, there is only one bug under active attack, and none are publicly known this month. While this is encouraging, it does not mean we\u2019re seeing less exploitation in the wild. It does mean we are seeing fewer 0-days exploited in the wild. This makes sense, as AI is better at reversing patches than it is at finding and exploiting bugs in closed-source software. \nLet\u2019s begin by covering some of the more severe and interesting patches released this month.\n-              CVE-2026-124194 - Microsoft Outlook Spoofing VulnerabilityThis is the one bug under active attack this month. It\u2019s labeled spoofing, but the impact is bigger than the name suggests. An attacker sends a specially crafted message file and convinces a user to open it. Outlook then connects to an attacker-controlled network location without showing the usual external-content warning, which discloses the user\u2019s NTLMv2 hash. The attacker can use that hash to authenticate as the user. The Preview Pane is not an attack vector, and the CVSS is only 6.5, so don\u2019t let the score lull you. Microsoft marks it as exploited, so this one goes to the top of the list.\n-              CVE-2026-116928 - Windows Search Remote Code Execution VulnerabilityWe start with Windows Search, which is reached through Exchange Server. This bug allows an unauthenticated attacker to send an email with a specially crafted attachment that triggers the bug when the server automatically indexes it. The recipient never opens anything. It is a zero-click code execution bug on a high-value target. It\u2019s also a CVSS 9.8 and clearly more severe than any of the nine patches Exchange receives this month.\n-              CVE-2026-119958 - Windows LDAP - Lightweight Directory Access Protocol Remote Code Execution VulnerabilityThis patch addresses a bug that allows an unauthenticated attacker to exploit an out-of-bounds (OOB) write (CWE-787) by sending crafted LDAP calls over the network, with no user interaction. Since it runs code in the LDAP service context, it could be quite destructive, especially on Domain Controllers. Test and deploy this one quickly.\n-              CVE-2026-119990 - Azure OpenAI Elevation of Privilege VulnerabilityThis is an odd duck. The bulletin says \u201cCustomer Action Required: Yes\u201d for this bug, but nothing in the advisory tells customers what to do. There are no mitigations, workarounds, or customer steps. The FAQ says an unauthenticated attacker can send a crafted request over the internet to an affected Azure OpenAI service, with no account or user interaction. The impact is access to orchestration information, workflow changes, or service disruption. Hopefully, Microsoft adds some direction here soon.\n-              CVE-2026-119952 - Windows Schannel Remote Code Execution VulnerabilityThis flaw allows an unauthenticated attacker to exploit arbitrary code over a network without user interaction. Microsoft rates this bug as \u201cExploitation More Likely\u201d. It is one of only a few Critical-rated patches with that rating. They also list the attack complexity as high, which is why the CVSS score is lower than the others. I would still put this near the top of my list.\n-              CVE-2026-95962 - Windows Virtual Filtering Platform (VFP) Remote Code Execution VulnerabilityI include this one because it\u2019s in a little-documented component. It\u2019s not the first CVE in VFP, but it appears to be just the second. It\u2019s a use-after-free that allows an unauthenticated attacker to get code execution on affected targets by sending a specially crafted packet to the affected service over the network. No authentication or user interaction is needed. There is a race condition here, but we see those overcome all the time at Pwn2Own. This should be an interesting component to watch.\n-              CVE-2026-112967 - Windows Xbox Live Networking Service Remote Code Execution VulnerabilityYou don\u2019t see a lot of Xbox Live bugs, but here we are with a CVSS 9.8.  This bug is a heap overflow that doesn\u2019t need authentication or user interaction. Microsoft states the attacker can \u201cgain remote code execution via an in-network attacker calling arbitrary endpoints.\u201d Is this really likely? Probably not, but it\u2019s fun to think of Xbox Live exploits in the wild.\nOn to those that are Wormable\u2026\nLast month saw 59 bugs that fit this definition. This month, it\u2019s a bit less. A total of 30 of the November CVEs fit my definition of wormable. Specifically, 17 contain the advisory language describing an unauthenticated attacker executing code over the network with no authentication or user interaction required. The other 13 use variant wording or have no FAQ, but their summaries and CVSS vectors (AV:N/PR:N/UI:N) describe the same thing. \nThese bugs are as follows:\n\n\nMessage Queuing (5): CVE-2026-116710, 119963, 119964, 109459, 119967\n\nDNS (4): CVE-2026-81384, 96092, 96177, 88218\n\nTwo each (8): Color Management (CVE-2026-96067, 96078), DHCP Server (CVE-2026-88243, 72998), DirectMusic (CVE-2026-95882, 95901) and Xbox (CVE-2026-112967, 66801)\n\nOne each (13): Exchange Server (CVE-2026-116928), LDAP (CVE-2026-119958), Schannel (CVE-2026-119952), CredSSP (CVE-2026-119962), Deployment Services (CVE-2026-119951), IIS (CVE-2026-119961), NAT (CVE-2026-113862), RPC Runtime (CVE-2026-118737), Media Foundation (CVE-2026-96157), iSCSI (CVE-2026-88234), Virtual Filtering Platform (CVE-2026-95962), eSCL Scanner (CVE-2026-95956) and Modern Device Management (CVE-2026-119945)\nI may be wrong about some of these, since a few advisories are light on detail. As always, I recommend testing and deploying these patches quickly, especially for network-facing services like DNS, DHCP, LDAP, and Exchange\nHere\u2019s the full list of CVEs released by Microsoft for November 2026:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n    \n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n \n \n \n  CVE\n  Title\n  Severity\n  CVSS\n  Public\n  Exploited\n  XI\n  Type\n \n \n  CVE-2026-124194\n  Microsoft Outlook\n  Spoofing Vulnerability\n  Moderate\n  6.5\n  No\n  Yes\n  0\n  Spoofing\n \n \n  CVE-2026-118148\n  Active Directory\n  Domain Services Elevation of Privilege Vulnerability\n  Critical\n  7.5\n  No\n  No\n  1\n  EoP\n \n \n  CVE-2026-114160\n  Azure Managed Grafana\n  Elevation of Privilege Vulnerability\n  Critical\n  9.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119990\n  Azure OpenAI Elevation\n  of Privilege Vulnerability\n  Critical\n  9.8\n  No\n  No\n  N/A\n  EoP\n \n \n  CVE-2026-119969\n  Graphic Fonts Remote\n  Code Execution Vulnerability\n  Critical\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-122194\n  Microsoft Defender\n  Remote Code Execution Vulnerability\n  Critical\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-118207\n  Microsoft Exchange\n  Server Remote Code Execution Vulnerability\n  Critical\n  8.8\n  No\n  No\n  1\n  RCE\n \n \n  CVE-2026-118292\n  Microsoft Office Excel\n  Remote Code Execution Vulnerability\n  Critical\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-118296\n  Microsoft Office Excel\n  Remote Code Execution Vulnerability\n  Critical\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-118297\n  Microsoft Office Excel\n  Remote Code Execution Vulnerability\n  Critical\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-118701\n  Microsoft Office Excel\n  Remote Code Execution Vulnerability\n  Critical\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-118702\n  Microsoft Office Excel\n  Remote Code Execution Vulnerability\n  Critical\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-118711\n  Microsoft Office Excel\n  Remote Code Execution Vulnerability\n  Critical\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-118713\n  Microsoft Office Excel\n  Remote Code Execution Vulnerability\n  Critical\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-118730\n  Microsoft Office Excel\n  Remote Code Execution Vulnerability\n  Critical\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-120786\n  Microsoft Office Excel\n  Remote Code Execution Vulnerability\n  Critical\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-120788\n  Microsoft Office Excel\n  Remote Code Execution Vulnerability\n  Critical\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-120789\n  Microsoft Office Excel\n  Remote Code Execution Vulnerability\n  Critical\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-124170\n  Microsoft Office Excel\n  Remote Code Execution Vulnerability\n  Critical\n  7.5\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-110043\n  Microsoft Office\n  Outlook Remote Code Execution Vulnerability\n  Critical\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-110068\n  Microsoft Office\n  Outlook Remote Code Execution Vulnerability\n  Critical\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-111309\n  Microsoft Office\n  Outlook Remote Code Execution Vulnerability\n  Critical\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-111289\n  Microsoft Office\n  Remote Code Execution Vulnerability\n  Critical\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-120003\n  Microsoft Office\n  Remote Code Execution Vulnerability\n  Critical\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-110047\n  Microsoft Office Word\n  Remote Code Execution Vulnerability\n  Critical\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-110067\n  Microsoft Office Word\n  Remote Code Execution Vulnerability\n  Critical\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-111285\n  Microsoft Office Word\n  Remote Code Execution Vulnerability\n  Critical\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-124185\n  Microsoft Office Word\n  Remote Code Execution Vulnerability\n  Critical\n  7.5\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-120005\n  Microsoft PowerPoint\n  Remote Code Execution Vulnerability\n  Critical\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-113749\n  Microsoft Windows\n  Codecs Library Remote Code Execution Vulnerability\n  Critical\n  7.5\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-118737\n  Remote Procedure Call\n  Runtime Remote Code Execution Vulnerability\n  Critical\n  8.1\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-118146\n  Windows Active\n  Directory Domain Services Remote Code Execution Vulnerability\n  Critical\n  8.8\n  No\n  No\n  1\n  RCE\n \n \n  CVE-2026-119962\n  Windows CredSSP Remote\n  Code Execution Vulnerability\n  Critical\n  8.1\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-119951\n  Windows Deployment\n  Services Remote Code Execution Vulnerability\n  Critical\n  8.1\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-125134\n  Windows Function\n  Discovery Resource Publication Remote Code Execution Vulnerability\n  Critical\n  7.5\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-118145\n  Windows Function\n  Discovery SSDP Provider Remote Code Execution Vulnerability\n  Critical\n  7.5\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-119966\n  Windows Graphics\n  Kernel Elevation of Privilege Vulnerability\n  Critical\n  7.5\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-125137\n  Windows Graphics\n  Kernel Elevation of Privilege Vulnerability\n  Critical\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-113753\n  Windows Hyper-V\n  Elevation of Privilege Vulnerability\n  Critical\n  8.2\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-113856\n  Windows Hyper-V\n  Elevation of Privilege Vulnerability\n  Critical\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-113860\n  Windows Hyper-V\n  Elevation of Privilege Vulnerability\n  Critical\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-113861\n  Windows Hyper-V\n  Elevation of Privilege Vulnerability\n  Critical\n  7.5\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-113864\n  Windows Hyper-V\n  Elevation of Privilege Vulnerability\n  Critical\n  6.4\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-113865\n  Windows Hyper-V\n  Elevation of Privilege Vulnerability\n  Critical\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119947\n  Windows Hyper-V\n  Elevation of Privilege Vulnerability\n  Critical\n  7.5\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119960\n  Windows Hyper-V\n  Elevation of Privilege Vulnerability\n  Critical\n  7.5\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119961\n  Windows Internet\n  Information Services Remote Code Execution Vulnerability\n  Critical\n  8.1\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-119958\n  Windows LDAP -\n  Lightweight Directory Access Protocol Remote Code Execution Vulnerability\n  Critical\n  9.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-109459\n  Windows Message\n  Queuing Queue Manager Remote Code Execution Vulnerability\n  Critical\n  8.1\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-119967\n  Windows Message\n  Queuing Queue Manager Remote Code Execution Vulnerability\n  Critical\n  8.1\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-116710\n  Windows Message\n  Queuing Remote Code Execution Vulnerability\n  Critical\n  8.1\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-119963\n  Windows Message\n  Queuing Remote Code Execution Vulnerability\n  Critical\n  8.1\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-119964\n  Windows Message\n  Queuing Remote Code Execution Vulnerability\n  Critical\n  8.1\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-113862\n  Windows Network\n  Address Translation (NAT) Remote Code Execution Vulnerability\n  Critical\n  8.1\n  No\n  No\n  1\n  RCE\n \n \n  CVE-2026-125136\n  Windows Network\n  Connected Devices Auto-Setup Service Remote Code Execution Vulnerability\n  Critical\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-113752\n  Windows Print Spooler\n  Components Remote Code Execution Vulnerability\n  Critical\n  7.5\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-114169\n  Windows Raw Image\n  Extension Remote Code Execution Vulnerability\n  Critical\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-119957\n  Windows Remote Desktop\n  Services Elevation of Privilege Vulnerability\n  Critical\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-113825\n  Windows SMB Server\n  Network Transport Driver (srvnet.sys) Remote Code Execution Vulnerability\n  Critical\n  7.5\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-119952\n  Windows Schannel\n  Remote Code Execution Vulnerability\n  Critical\n  8.1\n  No\n  No\n  1\n  RCE\n \n \n  CVE-2026-116928\n  Windows Search Remote\n  Code Execution Vulnerability\n  Critical\n  9.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-113859\n  Windows TCP/IP Remote\n  Code Execution Vulnerability\n  Critical\n  7.5\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-119382\n  Windows TPM Elevation\n  of Privilege Vulnerability\n  Critical\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-112967\n  Windows Xbox Live\n  Networking Service Remote Code Execution Vulnerability\n  Critical\n  9.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-109475\n  .NET Denial of Service\n  Vulnerability\n  Important\n  7.5\n  No\n  No\n  2\n  DoS\n \n \n  CVE-2026-118747\n  .NET Denial of Service\n  Vulnerability\n  Important\n  7.5\n  No\n  No\n  2\n  DoS\n \n \n  CVE-2026-120796\n  .NET Denial of Service\n  Vulnerability\n  Important\n  5.3\n  No\n  No\n  2\n  DoS\n \n \n  CVE-2026-105544\n  .NET Elevation of\n  Privilege Vulnerability\n  Important\n  7.5\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-114155\n  .NET Elevation of\n  Privilege Vulnerability\n  Important\n  7.5\n  No\n  No\n  N/A\n  EoP\n \n \n  CVE-2026-118746\n  .NET Security Feature\n  Bypass Vulnerability\n  Important\n  6.8\n  No\n  No\n  2\n  SFB\n \n \n  CVE-2026-84004\n  AMD Zen Information\n  Disclosure Vulnerability\n  Important\n  5.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-84005\n  AMD Zen Information\n  Disclosure Vulnerability\n  Important\n  5.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-109478\n  ASP.NET Core Denial of\n  Service Vulnerability\n  Important\n  7.5\n  No\n  No\n  2\n  DoS\n \n \n  CVE-2026-114147\n  ASP.NET Core Denial of\n  Service Vulnerability\n  Important\n  7.5\n  No\n  No\n  2\n  DoS\n \n \n  CVE-2026-114149\n  ASP.NET Core Denial of\n  Service Vulnerability\n  Important\n  7.5\n  No\n  No\n  2\n  DoS\n \n \n  CVE-2026-114154\n  ASP.NET Core Denial of\n  Service Vulnerability\n  Important\n  7.5\n  No\n  No\n  2\n  DoS\n \n \n  CVE-2026-118748\n  ASP.NET Core Denial of\n  Service Vulnerability\n  Important\n  7.5\n  No\n  No\n  2\n  DoS\n \n \n  CVE-2026-118749\n  ASP.NET Core Denial of\n  Service Vulnerability\n  Important\n  7.5\n  No\n  No\n  2\n  DoS\n \n \n  CVE-2026-118750\n  ASP.NET Core Denial of\n  Service Vulnerability\n  Important\n  7.5\n  No\n  No\n  2\n  DoS\n \n \n  CVE-2026-109481\n  ASP.NET Core Elevation\n  of Privilege Vulnerability\n  Important\n  7.5\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-114146\n  ASP.NET Core Elevation\n  of Privilege Vulnerability\n  Important\n  9\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-118741\n  ASP.NET Core Elevation\n  of Privilege Vulnerability\n  Important\n  8.1\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-109476\n  ASP.NET Core\n  Information Disclosure Vulnerability\n  Important\n  6.1\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-114150\n  ASP.NET Core\n  Information Disclosure Vulnerability\n  Important\n  5.9\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-114156\n  ASP.NET Core Security\n  Feature Bypass Vulnerability\n  Important\n  6.5\n  No\n  No\n  2\n  SFB\n \n \n  CVE-2026-114157\n  ASP.NET Core Security\n  Feature Bypass Vulnerability\n  Important\n  7.5\n  No\n  No\n  2\n  SFB\n \n \n  CVE-2026-118735\n  Active Directory\n  Domain Services Elevation of Privilege Vulnerability\n  Important\n  7.5\n  No\n  No\n  3\n  EoP\n \n \n  CVE-2026-123387\n  Active Directory\n  Domain Services Elevation of Privilege Vulnerability\n  Important\n  8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119889\n  ActiveSyncProvider\n  Information Disclosure Vulnerability\n  Important\n  6.5\n  No\n  No\n  3\n  Info\n \n \n  CVE-2026-120006\n  Aspire Elevation of\n  Privilege Vulnerability\n  Important\n  \n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-120778\n  Aspire Elevation of\n  Privilege Vulnerability\n  Important\n  7.3\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-120792\n  Aspire Information\n  Disclosure Vulnerability\n  Important\n  7.3\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-118740\n  Aspire Security\n  Feature Bypass Vulnerability\n  Important\n  9.1\n  No\n  No\n  2\n  SFB\n \n \n  CVE-2026-109457\n  Azure CLI Remote Code\n  Execution Vulnerability\n  Important\n  8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-121668\n  Azure Confidential\n  Clean Rooms Tampering Vulnerability\n  Important\n  \n  No\n  No\n  2\n  Tampering\n \n \n  CVE-2026-102224\n  Azure CycleCloud\n  Elevation of Privilege Vulnerability\n  Important\n  8.4\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-113822\n  Azure CycleCloud\n  Elevation of Privilege Vulnerability\n  Important\n  6.5\n  No\n  No\n  N/A\n  EoP\n \n \n  CVE-2026-114161\n  Azure CycleCloud\n  Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-113823\n  Azure CycleCloud\n  Information Disclosure Vulnerability\n  Important\n  7.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-120783\n  Azure DevOps Server\n  Elevation of Privilege Vulnerability\n  Important\n  6.4\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-85923\n  Azure DevOps Server\n  Elevation of Privilege Vulnerability\n  Important\n  8.8\n  No\n  No\n  N/A\n  EoP\n \n \n  CVE-2026-112745\n  Azure DevOps Server\n  Information Disclosure Vulnerability\n  Important\n  6.5\n  No\n  No\n  1\n  Info\n \n \n  CVE-2026-109467\n  Azure DevOps Server\n  Remote Code Execution Vulnerability\n  Important\n  9.9\n  No\n  No\n  N/A\n  RCE\n \n \n  CVE-2026-109462\n  Azure Firmware\n  Security Feature Bypass Vulnerability\n  Important\n  4.4\n  No\n  No\n  2\n  SFB\n \n \n  CVE-2026-118742\n  Azure Front Door\n  Elevation of Privilege Vulnerability\n  Important\n  8.6\n  No\n  No\n  N/A\n  EoP\n \n \n  CVE-2026-105494\n  Azure NFS mount helper\n  (aznfs) Elevation of Privilege Vulnerability\n  Important\n  \n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119989\n  Azure Pipelines Remote\n  Code Execution Vulnerability\n  Important\n  8.2\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-96007\n  Connected Devices\n  Platform Service (Cdpsvc) Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119883\n  Data Deduplication\n  Security Feature Bypass Vulnerability\n  Important\n  3.3\n  No\n  No\n  2\n  SFB\n \n \n  CVE-2026-95963\n  Data Sharing Service\n  Client Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  1\n  EoP\n \n \n  CVE-2026-105528\n  Desktop Window Manager\n  Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-105581\n  Desktop Window Manager\n  Elevation of Privilege Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-113819\n  Desktop Window Manager\n  Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  1\n  EoP\n \n \n  CVE-2026-96103\n  Desktop Window Manager\n  Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-96172\n  Desktop Window Manager\n  Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-96174\n  Desktop Window Manager\n  Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-96175\n  Desktop Window Manager\n  Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-94507\n  DirectX Elevation of\n  Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-83953\n  GitHub Copilot for\n  Jetbrains Information Disclosure Vulnerability\n  Important\n  5.5\n  No\n  No\n  N/A\n  Info\n \n \n  CVE-2026-96084\n  Graphic Fonts\n  Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-88211\n  Graphic Fonts\n  Information Disclosure Vulnerability\n  Important\n  5.7\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-100204\n  HEIF Image Extensions\n  Remote Code Execution Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-114164\n  HEVC Video Extensions\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-114165\n  HEVC Video Extensions\n  Remote Code Execution Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-114167\n  HEVC Video Extensions\n  Remote Code Execution Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-122173\n  HID Parser Library\n  Elevation of Privilege Vulnerability\n  Important\n  6.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-125135\n  HID Parser Library\n  Elevation of Privilege Vulnerability\n  Important\n  6.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-96010\n  HID Parser Library\n  Elevation of Privilege Vulnerability\n  Important\n  8.8\n  No\n  No\n  3\n  EoP\n \n \n  CVE-2026-96974\n  HID Parser Library\n  Elevation of Privilege Vulnerability\n  Important\n  6.8\n  No\n  No\n  3\n  EoP\n \n \n  CVE-2026-96979\n  HID Parser Library\n  Elevation of Privilege Vulnerability\n  Important\n  6.8\n  No\n  No\n  3\n  EoP\n \n \n  CVE-2026-96982\n  HID Parser Library\n  Elevation of Privilege Vulnerability\n  Important\n  6.8\n  No\n  No\n  3\n  EoP\n \n \n  CVE-2026-96059\n  HID class driver\n  Information Disclosure Vulnerability\n  Important\n  5.5\n  No\n  No\n  3\n  Info\n \n \n  CVE-2026-119942\n  HTTP.sys Information\n  Disclosure Vulnerability\n  Important\n  4.7\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-119946\n  HTTP.sys Information\n  Disclosure Vulnerability\n  Important\n  5.9\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-70003\n  JDBC Driver for SQL\n  Server Security Feature Bypass Vulnerability\n  Important\n  8.7\n  No\n  No\n  2\n  SFB\n \n \n  CVE-2026-119937\n  Kernel Streaming\n  Service Driver Elevation of Privilege Vulnerability\n  Important\n  6.6\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-105537\n  Mailslot File System\n  Information Disclosure Vulnerability\n  Important\n  5.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-109485\n  Microsoft 365 Agents\n  SDK Information Disclosure Vulnerability\n  Important\n  6.3\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-112974\n  Microsoft Account\n  Tampering Vulnerability\n  Important\n  5.5\n  No\n  No\n  2\n  Tampering\n \n \n  CVE-2026-112982\n  Microsoft Account\n  Tampering Vulnerability\n  Important\n  5.5\n  No\n  No\n  2\n  Tampering\n \n \n  CVE-2026-96158\n  Microsoft ActiveX\n  Installer Service Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-108470\n  Microsoft\n  Authentication Library (MSAL) for Node.js Information Disclosure\n  Vulnerability\n  Important\n  \n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-108469\n  Microsoft\n  Authentication Library for JavaScript Spoofing Vulnerability\n  Important\n  6.8\n  No\n  No\n  2\n  Spoofing\n \n \n  CVE-2026-118288\n  Microsoft Azure File\n  Sync Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-70120\n  Microsoft Bluetooth\n  Driver Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-85929\n  Microsoft Brokering\n  File System Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-96054\n  Microsoft Color\n  Management Remote Code Execution Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-96067\n  Microsoft Color\n  Management Remote Code Execution Vulnerability\n  Important\n  9.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-96078\n  Microsoft Color\n  Management Remote Code Execution Vulnerability\n  Important\n  9.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-119991\n  Microsoft\n  Configuration Manager Information Disclosure Vulnerability\n  Important\n  5.9\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-95882\n  Microsoft DirectMusic\n  Remote Code Execution Vulnerability\n  Important\n  9.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-95891\n  Microsoft DirectMusic\n  Remote Code Execution Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-95896\n  Microsoft DirectMusic\n  Remote Code Execution Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-95901\n  Microsoft DirectMusic\n  Remote Code Execution Vulnerability\n  Important\n  9.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-122196\n  Microsoft Dynamics 365\n  (on-premises) Information Disclosure Vulnerability\n  Important\n  6.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-109460\n  Microsoft Entra\n  Private Network Connector Information Disclosure Vulnerability\n  Important\n  5.5\n  No\n  No\n  N/A\n  Info\n \n \n  CVE-2026-118153\n  Microsoft Exchange\n  Server Denial of Service Vulnerability\n  Important\n  7.5\n  No\n  No\n  2\n  DoS\n \n \n  CVE-2026-118150\n  Microsoft Exchange\n  Server Elevation of Privilege Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-118151\n  Microsoft Exchange\n  Server Elevation of Privilege Vulnerability\n  Important\n  7.2\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-118154\n  Microsoft Exchange\n  Server Elevation of Privilege Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-118157\n  Microsoft Exchange\n  Server Elevation of Privilege Vulnerability\n  Important\n  7.2\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-118149\n  Microsoft Exchange\n  Server Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  3\n  RCE\n \n \n  CVE-2026-118152\n  Microsoft Exchange\n  Server Spoofing Vulnerability\n  Important\n  6.5\n  No\n  No\n  2\n  Spoofing\n \n \n  CVE-2026-118208\n  Microsoft Exchange\n  Server Spoofing Vulnerability\n  Important\n  7.1\n  No\n  No\n  2\n  Spoofing\n \n \n  CVE-2026-114162\n  Microsoft Graph\n  Elevation of Privilege Vulnerability\n  Important\n  9.1\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-112754\n  Microsoft Graphics\n  Component Information Disclosure Vulnerability\n  Important\n  5.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-122987\n  Microsoft High\n  Performance Computing (HPC) Pack Elevation of Privilege Vulnerability\n  Important\n  5.9\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-105505\n  Microsoft Input Method\n  Editor (IME) Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-105578\n  Microsoft JScript\n  Remote Code Execution Vulnerability\n  Important\n  7.5\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-109492\n  Microsoft MCP Gateway\n  Elevation of Privilege Vulnerability\n  Important\n  \n  No\n  No\n  N/A\n  EoP\n \n \n  CVE-2026-108411\n  Microsoft ODBC Driver\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-109493\n  Microsoft Office\n  Access Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-109498\n  Microsoft Office\n  Access Remote Code Execution Vulnerability\n  Important\n  7.5\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-110058\n  Microsoft Office\n  Access Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-110059\n  Microsoft Office\n  Access Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-110060\n  Microsoft Office\n  Access Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-111301\n  Microsoft Office\n  Access Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-111305\n  Microsoft Office\n  Access Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-118715\n  Microsoft Office Excel\n  Elevation of Privilege Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-118725\n  Microsoft Office Excel\n  Elevation of Privilege Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-111292\n  Microsoft Office Excel\n  Information Disclosure Vulnerability\n  Important\n  6.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-118300\n  Microsoft Office Excel\n  Information Disclosure Vulnerability\n  Important\n  6.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-118727\n  Microsoft Office Excel\n  Information Disclosure Vulnerability\n  Important\n  6.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-118728\n  Microsoft Office Excel\n  Information Disclosure Vulnerability\n  Important\n  6.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-119999\n  Microsoft Office Excel\n  Information Disclosure Vulnerability\n  Important\n  6.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-123395\n  Microsoft Office Excel\n  Information Disclosure Vulnerability\n  Important\n  5.9\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-124178\n  Microsoft Office Excel\n  Information Disclosure Vulnerability\n  Important\n  6.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-124179\n  Microsoft Office Excel\n  Information Disclosure Vulnerability\n  Important\n  6.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-124183\n  Microsoft Office Excel\n  Information Disclosure Vulnerability\n  Important\n  6.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-116927\n  Microsoft Office Excel\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-118293\n  Microsoft Office Excel\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-118294\n  Microsoft Office Excel\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-118295\n  Microsoft Office Excel\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-118298\n  Microsoft Office Excel\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-118299\n  Microsoft Office Excel\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-118301\n  Microsoft Office Excel\n  Remote Code Execution Vulnerability\n  Important\n  7.5\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-118302\n  Microsoft Office Excel\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-118700\n  Microsoft Office Excel\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-118703\n  Microsoft Office Excel\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-118704\n  Microsoft Office Excel\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-118705\n  Microsoft Office Excel\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-118706\n  Microsoft Office Excel\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-118707\n  Microsoft Office Excel\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-118708\n  Microsoft Office Excel\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-118709\n  Microsoft Office Excel\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-118710\n  Microsoft Office Excel\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-118712\n  Microsoft Office Excel\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-118714\n  Microsoft Office Excel\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-118716\n  Microsoft Office Excel\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-118717\n  Microsoft Office Excel\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-118718\n  Microsoft Office Excel\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-118719\n  Microsoft Office Excel\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-118720\n  Microsoft Office Excel\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-118721\n  Microsoft Office Excel\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-118722\n  Microsoft Office Excel\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-118723\n  Microsoft Office Excel\n  Remote Code Execution Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-118724\n  Microsoft Office Excel\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-118726\n  Microsoft Office Excel\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-118729\n  Microsoft Office Excel\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-118731\n  Microsoft Office Excel\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-118732\n  Microsoft Office Excel\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-119986\n  Microsoft Office Excel\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-120785\n  Microsoft Office Excel\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  3\n  RCE\n \n \n  CVE-2026-120790\n  Microsoft Office Excel\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-120791\n  Microsoft Office Excel\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-123385\n  Microsoft Office Excel\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-124174\n  Microsoft Office Excel\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-124176\n  Microsoft Office Excel\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-124187\n  Microsoft Office Excel\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-124229\n  Microsoft Office Excel\n  Remote Code Execution Vulnerability\n  Important\n  6.6\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-111291\n  Microsoft Office\n  Information Disclosure Vulnerability\n  Important\n  6.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-111293\n  Microsoft Office\n  Information Disclosure Vulnerability\n  Important\n  6.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-112731\n  Microsoft Office\n  Information Disclosure Vulnerability\n  Important\n  6.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-119993\n  Microsoft Office\n  Outlook Information Disclosure Vulnerability\n  Important\n  6.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-119995\n  Microsoft Office\n  Outlook Remote Code Execution Vulnerability\n  Important\n  7.5\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-119996\n  Microsoft Office\n  Outlook Remote Code Execution Vulnerability\n  Important\n  7.5\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-119997\n  Microsoft Office\n  Outlook Remote Code Execution Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-123375\n  Microsoft Office\n  Outlook Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-123376\n  Microsoft Office\n  Outlook Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-123377\n  Microsoft Office\n  Outlook Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-123378\n  Microsoft Office\n  Outlook Remote Code Execution Vulnerability\n  Important\n  7.5\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-123379\n  Microsoft Office\n  Outlook Remote Code Execution Vulnerability\n  Important\n  7.5\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-123380\n  Microsoft Office\n  Outlook Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-123381\n  Microsoft Office\n  Outlook Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-123382\n  Microsoft Office\n  Outlook Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-123383\n  Microsoft Office\n  Outlook Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-123384\n  Microsoft Office\n  Outlook Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-124227\n  Microsoft Office\n  Outlook Remote Code Execution Vulnerability\n  Important\n  7.5\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-124228\n  Microsoft Office\n  Outlook Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-112738\n  Microsoft Office\n  PowerPoint Information Disclosure Vulnerability\n  Important\n  6.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-116922\n  Microsoft Office\n  PowerPoint Information Disclosure Vulnerability\n  Important\n  6.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-112734\n  Microsoft Office\n  PowerPoint Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-112737\n  Microsoft Office\n  PowerPoint Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-120001\n  Microsoft Office\n  PowerPoint Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-111286\n  Microsoft Office\n  Remote Code Execution Vulnerability\n  Important\n  7.5\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-116717\n  Microsoft Office\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-122198\n  Microsoft Office\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-119998\n  Microsoft Office\n  Security Feature Bypass Vulnerability\n  Important\n  6.5\n  No\n  No\n  2\n  SFB\n \n \n  CVE-2026-109466\n  Microsoft Office\n  SharePoint Elevation of Privilege Vulnerability\n  Important\n  8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-109495\n  Microsoft Office\n  SharePoint Elevation of Privilege Vulnerability\n  Important\n  6.6\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-109502\n  Microsoft Office\n  SharePoint Elevation of Privilege Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-111296\n  Microsoft Office\n  SharePoint Elevation of Privilege Vulnerability\n  Important\n  8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-123391\n  Microsoft Office\n  SharePoint Elevation of Privilege Vulnerability\n  Important\n  8.8\n  No\n  No\n  3\n  EoP\n \n \n  CVE-2026-80095\n  Microsoft Office\n  SharePoint Elevation of Privilege Vulnerability\n  Important\n  9\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-88176\n  Microsoft Office\n  SharePoint Elevation of Privilege Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-109455\n  Microsoft Office\n  SharePoint Information Disclosure Vulnerability\n  Important\n  6.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-110057\n  Microsoft Office\n  SharePoint Information Disclosure Vulnerability\n  Important\n  6.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-124210\n  Microsoft Office\n  SharePoint Information Disclosure Vulnerability\n  Important\n  6.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-109464\n  Microsoft Office\n  SharePoint Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-109472\n  Microsoft Office\n  SharePoint Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-109499\n  Microsoft Office\n  SharePoint Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-110044\n  Microsoft Office\n  SharePoint Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-120000\n  Microsoft Office\n  SharePoint Remote Code Execution Vulnerability\n  Important\n  7.5\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-123390\n  Microsoft Office\n  SharePoint Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  N/A\n  RCE\n \n \n  CVE-2026-109454\n  Microsoft Office\n  SharePoint Spoofing Vulnerability\n  Important\n  9\n  No\n  No\n  2\n  Spoofing\n \n \n  CVE-2026-109456\n  Microsoft Office\n  SharePoint Spoofing Vulnerability\n  Important\n  4.6\n  No\n  No\n  2\n  Spoofing\n \n \n  CVE-2026-109497\n  Microsoft Office\n  SharePoint Spoofing Vulnerability\n  Important\n  7.3\n  No\n  No\n  2\n  Spoofing\n \n \n  CVE-2026-109504\n  Microsoft Office\n  SharePoint Spoofing Vulnerability\n  Important\n  7.3\n  No\n  No\n  2\n  Spoofing\n \n \n  CVE-2026-110045\n  Microsoft Office\n  SharePoint Spoofing Vulnerability\n  Important\n  7.3\n  No\n  No\n  2\n  Spoofing\n \n \n  CVE-2026-110065\n  Microsoft Office\n  SharePoint Spoofing Vulnerability\n  Important\n  7.3\n  No\n  No\n  2\n  Spoofing\n \n \n  CVE-2026-111297\n  Microsoft Office\n  SharePoint Spoofing Vulnerability\n  Important\n  8\n  No\n  No\n  2\n  Spoofing\n \n \n  CVE-2026-111300\n  Microsoft Office\n  SharePoint Spoofing Vulnerability\n  Important\n  7.3\n  No\n  No\n  2\n  Spoofing\n \n \n  CVE-2026-111303\n  Microsoft Office\n  SharePoint Spoofing Vulnerability\n  Important\n  7.3\n  No\n  No\n  2\n  Spoofing\n \n \n  CVE-2026-112736\n  Microsoft Office\n  SharePoint Spoofing Vulnerability\n  Important\n  5.3\n  No\n  No\n  2\n  Spoofing\n \n \n  CVE-2026-109494\n  Microsoft Office Visio\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-109496\n  Microsoft Office Visio\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-110046\n  Microsoft Office Word\n  Information Disclosure Vulnerability\n  Important\n  6.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-110051\n  Microsoft Office Word\n  Information Disclosure Vulnerability\n  Important\n  6.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-110066\n  Microsoft Office Word\n  Information Disclosure Vulnerability\n  Important\n  6.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-111288\n  Microsoft Office Word\n  Information Disclosure Vulnerability\n  Important\n  6.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-112720\n  Microsoft Office Word\n  Information Disclosure Vulnerability\n  Important\n  5.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-116721\n  Microsoft Office Word\n  Information Disclosure Vulnerability\n  Important\n  6.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-124233\n  Microsoft Office Word\n  Information Disclosure Vulnerability\n  Important\n  6.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-109491\n  Microsoft Office Word\n  Remote Code Execution Vulnerability\n  Important\n  7.5\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-109500\n  Microsoft Office Word\n  Remote Code Execution Vulnerability\n  Important\n  7.5\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-109501\n  Microsoft Office Word\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-109503\n  Microsoft Office Word\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-109505\n  Microsoft Office Word\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-110050\n  Microsoft Office Word\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-110052\n  Microsoft Office Word\n  Remote Code Execution Vulnerability\n  Important\n  7.5\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-110053\n  Microsoft Office Word\n  Remote Code Execution Vulnerability\n  Important\n  7.5\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-110054\n  Microsoft Office Word\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-110056\n  Microsoft Office Word\n  Remote Code Execution Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-110061\n  Microsoft Office Word\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-110062\n  Microsoft Office Word\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-110064\n  Microsoft Office Word\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-111287\n  Microsoft Office Word\n  Remote Code Execution Vulnerability\n  Important\n  7.5\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-111290\n  Microsoft Office Word\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-111294\n  Microsoft Office Word\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-111295\n  Microsoft Office Word\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-111298\n  Microsoft Office Word\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-111299\n  Microsoft Office Word\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-111302\n  Microsoft Office Word\n  Remote Code Execution Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-111304\n  Microsoft Office Word\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-111306\n  Microsoft Office Word\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-111307\n  Microsoft Office Word\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-111308\n  Microsoft Office Word\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-111310\n  Microsoft Office Word\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-112714\n  Microsoft Office Word\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-112715\n  Microsoft Office Word\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-112716\n  Microsoft Office Word\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-112717\n  Microsoft Office Word\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-112718\n  Microsoft Office Word\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-112719\n  Microsoft Office Word\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-112721\n  Microsoft Office Word\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-112722\n  Microsoft Office Word\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-112723\n  Microsoft Office Word\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-112724\n  Microsoft Office Word\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-112726\n  Microsoft Office Word\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-112728\n  Microsoft Office Word\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-112729\n  Microsoft Office Word\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-112730\n  Microsoft Office Word\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-112733\n  Microsoft Office Word\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-112735\n  Microsoft Office Word\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-112739\n  Microsoft Office Word\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-112741\n  Microsoft Office Word\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-116718\n  Microsoft Office Word\n  Remote Code Execution Vulnerability\n  Important\n  7.5\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-116719\n  Microsoft Office Word\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-116720\n  Microsoft Office Word\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-116722\n  Microsoft Office Word\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-116923\n  Microsoft Office Word\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-116925\n  Microsoft Office Word\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-123394\n  Microsoft Office Word\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-109487\n  Microsoft PowerPoint\n  Remote Code Execution Vulnerability\n  Important\n  7.5\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-122985\n  Microsoft PowerShell\n  Information Disclosure Vulnerability\n  Important\n  6.1\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-113815\n  Microsoft PowerShell\n  Security Feature Bypass Vulnerability\n  Important\n  4.7\n  No\n  No\n  2\n  SFB\n \n \n  CVE-2026-124226\n  Microsoft PowerShell\n  Security Feature Bypass Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  SFB\n \n \n  CVE-2026-105512\n  Microsoft QUIC Denial\n  of Service Vulnerability\n  Important\n  7.5\n  No\n  No\n  2\n  DoS\n \n \n  CVE-2026-88236\n  Microsoft QUIC Denial\n  of Service Vulnerability\n  Important\n  7.5\n  No\n  No\n  2\n  DoS\n \n \n  CVE-2026-114166\n  Microsoft Raw Image\n  Extension Information Disclosure Vulnerability\n  Important\n  5.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-105492\n  Microsoft Remote\n  Registry Service Denial of Service Vulnerability\n  Important\n  5.3\n  No\n  No\n  2\n  DoS\n \n \n  CVE-2026-116929\n  Microsoft SQL Server\n  Elevation of Privilege Vulnerability\n  Important\n  7.5\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-116934\n  Microsoft SQL Server\n  Elevation of Privilege Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-116944\n  Microsoft SQL Server\n  Elevation of Privilege Vulnerability\n  Important\n  7.2\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-118105\n  Microsoft SQL Server\n  Elevation of Privilege Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-118108\n  Microsoft SQL Server\n  Elevation of Privilege Vulnerability\n  Important\n  7.5\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-118109\n  Microsoft SQL Server\n  Elevation of Privilege Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-118110\n  Microsoft SQL Server\n  Elevation of Privilege Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-118111\n  Microsoft SQL Server\n  Elevation of Privilege Vulnerability\n  Important\n  8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-118112\n  Microsoft SQL Server\n  Elevation of Privilege Vulnerability\n  Important\n  8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-118113\n  Microsoft SQL Server\n  Elevation of Privilege Vulnerability\n  Important\n  8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-118114\n  Microsoft SQL Server\n  Elevation of Privilege Vulnerability\n  Important\n  7.5\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-118115\n  Microsoft SQL Server\n  Elevation of Privilege Vulnerability\n  Important\n  7.5\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-118116\n  Microsoft SQL Server\n  Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-118117\n  Microsoft SQL Server\n  Elevation of Privilege Vulnerability\n  Important\n  8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-118118\n  Microsoft SQL Server\n  Elevation of Privilege Vulnerability\n  Important\n  8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-118119\n  Microsoft SQL Server\n  Elevation of Privilege Vulnerability\n  Important\n  8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-118120\n  Microsoft SQL Server\n  Elevation of Privilege Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-66813\n  Microsoft SQL Server\n  Elevation of Privilege Vulnerability\n  Important\n  8.1\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-67375\n  Microsoft SQL Server\n  Elevation of Privilege Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-67387\n  Microsoft SQL Server\n  Elevation of Privilege Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-84010\n  Microsoft SQL Server\n  Elevation of Privilege Vulnerability\n  Important\n  7.5\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-94513\n  Microsoft SQL Server\n  Elevation of Privilege Vulnerability\n  Important\n  8\n  No\n  No\n  3\n  EoP\n \n \n  CVE-2026-116932\n  Microsoft SQL Server\n  Information Disclosure Vulnerability\n  Important\n  6.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-116935\n  Microsoft SQL Server\n  Information Disclosure Vulnerability\n  Important\n  6.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-116939\n  Microsoft SQL Server\n  Information Disclosure Vulnerability\n  Important\n  5.7\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-116940\n  Microsoft SQL Server\n  Information Disclosure Vulnerability\n  Important\n  4.9\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-116943\n  Microsoft SQL Server\n  Information Disclosure Vulnerability\n  Important\n  7.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-118102\n  Microsoft SQL Server\n  Information Disclosure Vulnerability\n  Important\n  5.9\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-118103\n  Microsoft SQL Server\n  Information Disclosure Vulnerability\n  Important\n  6.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-118104\n  Microsoft SQL Server\n  Information Disclosure Vulnerability\n  Important\n  6.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-67382\n  Microsoft SQL Server\n  Information Disclosure Vulnerability\n  Important\n  6.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-68783\n  Microsoft SQL Server\n  Information Disclosure Vulnerability\n  Important\n  6.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-116930\n  Microsoft SQL Server\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-116931\n  Microsoft SQL Server\n  Remote Code Execution Vulnerability\n  Important\n  7.5\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-116933\n  Microsoft SQL Server\n  Remote Code Execution Vulnerability\n  Important\n  7.2\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-116936\n  Microsoft SQL Server\n  Remote Code Execution Vulnerability\n  Important\n  7.2\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-116937\n  Microsoft SQL Server\n  Remote Code Execution Vulnerability\n  Important\n  7.5\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-116938\n  Microsoft SQL Server\n  Remote Code Execution Vulnerability\n  Important\n  7.5\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-116941\n  Microsoft SQL Server\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-116942\n  Microsoft SQL Server\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-116945\n  Microsoft SQL Server\n  Remote Code Execution Vulnerability\n  Important\n  9.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-116946\n  Microsoft SQL Server\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-116947\n  Microsoft SQL Server\n  Remote Code Execution Vulnerability\n  Important\n  7.5\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-118106\n  Microsoft SQL Server\n  Remote Code Execution Vulnerability\n  Important\n  8.1\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-67372\n  Microsoft SQL Server\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-67374\n  Microsoft SQL Server\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-67391\n  Microsoft SQL Server\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  3\n  RCE\n \n \n  CVE-2026-67632\n  Microsoft SQL Server\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  3\n  RCE\n \n \n  CVE-2026-67637\n  Microsoft SQL Server\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  3\n  RCE\n \n \n  CVE-2026-67646\n  Microsoft SQL Server\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  3\n  RCE\n \n \n  CVE-2026-120002\n  Microsoft SharePoint\n  Server Elevation of Privilege Vulnerability\n  Important\n  9.9\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-116926\n  Microsoft Teams\n  Spoofing Vulnerability\n  Important\n  7.5\n  No\n  No\n  2\n  Spoofing\n \n \n  CVE-2026-122979\n  Microsoft Teams for\n  Android Spoofing Vulnerability\n  Important\n  8.1\n  No\n  No\n  N/A\n  Spoofing\n \n \n  CVE-2026-69901\n  Microsoft Teams for\n  Android Spoofing Vulnerability\n  Important\n  7.5\n  No\n  No\n  N/A\n  Spoofing\n \n \n  CVE-2026-121681\n  Microsoft Trace Data\n  Helper Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-122172\n  Microsoft Trace Data\n  Helper Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-116698\n  Microsoft WDAC OLE DB\n  provider for SQL Remote Code Execution Vulnerability\n  Important\n  7.5\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-116699\n  Microsoft WDAC OLE DB\n  provider for SQL Remote Code Execution Vulnerability\n  Important\n  6.5\n  No\n  No\n  3\n  RCE\n \n \n  CVE-2026-85838\n  Microsoft WDAC OLE DB\n  provider for SQL Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-85839\n  Microsoft WDAC OLE DB\n  provider for SQL Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-88222\n  Microsoft WDAC OLE DB\n  provider for SQL Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-119987\n  Microsoft Windows App\n  Store Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-96150\n  Microsoft Windows\n  Codecs Library Information Disclosure Vulnerability\n  Important\n  5.6\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-122168\n  Microsoft Windows\n  Media Foundation Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-96157\n  Microsoft Windows\n  Media Foundation Remote Code Execution Vulnerability\n  Important\n  9.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-105586\n  Microsoft Windows SCSI\n  Class System File Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-113821\n  Microsoft Windows SCSI\n  Class System File Information Disclosure Vulnerability\n  Important\n  4.1\n  No\n  No\n  3\n  Info\n \n \n  CVE-2026-119943\n  Microsoft Windows\n  Search Component Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119954\n  Microsoft Windows\n  Search Component Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119904\n  Microsoft Windows\n  Speech Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-97002\n  Microsoft Windows\n  VMSwitch Elevation of Privilege Vulnerability\n  Important\n  7.5\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-110048\n  Microsoft Word Remote\n  Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-110049\n  Microsoft Word Remote\n  Code Execution Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-110055\n  Microsoft Word Remote\n  Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-113759\n  Microsoft Word Remote\n  Code Execution Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-119881\n  Microsoft XPS Document\n  Converter Elevation of Privilege Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119880\n  Microsoft XPS Document\n  Converter Remote Code Execution Vulnerability\n  Important\n  7.5\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-122171\n  Microsoft XPS Document\n  Converter Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-66801\n  Microsoft Xbox Remote\n  Code Execution Vulnerability\n  Important\n  \n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-62903\n  Microsoft.Data.SqlClient\n  Information Disclosure Vulnerability\n  Important\n  \n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-124224\n  PowerShell Elevation\n  of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  3\n  EoP\n \n \n  CVE-2026-121669\n  PowerShell Information\n  Disclosure Vulnerability\n  Important\n  6.1\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-121674\n  PowerShell Information\n  Disclosure Vulnerability\n  Important\n  6.1\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-121675\n  PowerShell Information\n  Disclosure Vulnerability\n  Important\n  6.1\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-119387\n  Quality Windows\n  Audio/Video Experience (QWAVE) service Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119388\n  Quality Windows\n  Audio/Video Experience (QWAVE) service Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-123389\n  Quality Windows\n  Audio/Video Experience (QWAVE) service Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  3\n  EoP\n \n \n  CVE-2026-83894\n  RPC Runtime Elevation\n  of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-116697\n  Reliable Multicast\n  Transport Driver (RMCAST) Denial of Service Vulnerability\n  Important\n  5.9\n  No\n  No\n  2\n  DoS\n \n \n  CVE-2026-119853\n  Remote Access API\n  Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  1\n  EoP\n \n \n  CVE-2026-119390\n  Remote Desktop Client\n  Remote Code Execution Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-119858\n  Remote Desktop Client\n  Remote Code Execution Vulnerability\n  Important\n  7.5\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-119934\n  Remote Desktop Client\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-95964\n  Remote Desktop Client\n  Remote Code Execution Vulnerability\n  Important\n  7.5\n  No\n  No\n  3\n  RCE\n \n \n  CVE-2026-119824\n  Remote Desktop Client\n  Tampering Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  Tampering\n \n \n  CVE-2026-80094\n  Remote Desktop Gateway\n  Service Elevation of Privilege Vulnerability\n  Important\n  7.5\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-108401\n  Remote Desktop\n  Services Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-119972\n  Remote Procedure Call\n  Denial of Service Vulnerability\n  Important\n  5.9\n  No\n  No\n  2\n  DoS\n \n \n  CVE-2026-96017\n  Role: DNS Server\n  Denial of Service Vulnerability\n  Important\n  4.9\n  No\n  No\n  3\n  DoS\n \n \n  CVE-2026-96975\n  Role: DNS Server\n  Denial of Service Vulnerability\n  Important\n  5.9\n  No\n  No\n  2\n  DoS\n \n \n  CVE-2026-88111\n  SQL Server Remote Code\n  Execution Vulnerability\n  Important\n  7.5\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-94511\n  SQL Server Remote Code\n  Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  3\n  RCE\n \n \n  CVE-2026-96989\n  Secondary Logon\n  Information Disclosure Vulnerability\n  Important\n  5.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-118140\n  Server for NFS\n  Information Disclosure Vulnerability\n  Important\n  5.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-88235\n  Servicing Stack\n  Updates Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  1\n  EoP\n \n \n  CVE-2026-113748\n  Software Protection\n  Platform (SPP) Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119395\n  Storport.sys Driver\n  Information Disclosure Vulnerability\n  Important\n  4\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-119849\n  Virtual Hard Disk\n  (VHD) Miniport Driver Remote Code Execution Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-119981\n  Visual Studio Code\n  Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119976\n  Visual Studio Code\n  GitHub Pull Requests and Issues Extension Information Disclosure\n  Vulnerability\n  Important\n  6.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-102230\n  Visual Studio Code\n  Information Disclosure Vulnerability\n  Important\n  7.4\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-119975\n  Visual Studio Code\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-119985\n  Visual Studio Code\n  Remote Code Execution Vulnerability\n  Important\n  8.3\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-120779\n  Visual Studio Code\n  Remote Code Execution Vulnerability\n  Important\n  9.6\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-120780\n  Visual Studio Code\n  Remote Code Execution Vulnerability\n  Important\n  8.3\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-121662\n  Visual Studio Code\n  Remote Code Execution Vulnerability\n  Important\n  8.6\n  No\n  No\n  1\n  RCE\n \n \n  CVE-2026-121664\n  Visual Studio Code\n  Remote Code Execution Vulnerability\n  Important\n  8.3\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-70094\n  Visual Studio Code\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-102236\n  Visual Studio Code\n  Security Feature Bypass Vulnerability\n  Important\n  8.6\n  No\n  No\n  2\n  SFB\n \n \n  CVE-2026-114171\n  Visual Studio Code\n  Security Feature Bypass Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  SFB\n \n \n  CVE-2026-119982\n  Visual Studio Code\n  Security Feature Bypass Vulnerability\n  Important\n  6.5\n  No\n  No\n  2\n  SFB\n \n \n  CVE-2026-119983\n  Visual Studio Code\n  Security Feature Bypass Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  SFB\n \n \n  CVE-2026-120782\n  Visual Studio Code\n  Security Feature Bypass Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  SFB\n \n \n  CVE-2026-121660\n  Visual Studio Code\n  Security Feature Bypass Vulnerability\n  Important\n  7.5\n  No\n  No\n  2\n  SFB\n \n \n  CVE-2026-121661\n  Visual Studio Code\n  Security Feature Bypass Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  SFB\n \n \n  CVE-2026-121663\n  Visual Studio Code\n  Security Feature Bypass Vulnerability\n  Important\n  8.8\n  No\n  No\n  1\n  SFB\n \n \n  CVE-2026-121665\n  Visual Studio Code\n  Security Feature Bypass Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  SFB\n \n \n  CVE-2026-114151\n  Visual Studio Remote\n  Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-114152\n  Visual Studio Remote\n  Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-114158\n  Visual Studio Remote\n  Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-114159\n  Visual Studio Remote\n  Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-118745\n  Visual Studio Remote\n  Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-105017\n  Volume Shadow Copy\n  Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119941\n  Volume Shadow Copy\n  Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119825\n  Win32k Information\n  Disclosure Vulnerability\n  Important\n  5.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-119856\n  Win32k Information\n  Disclosure Vulnerability\n  Important\n  5.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-119910\n  Win32k Information\n  Disclosure Vulnerability\n  Important\n  4.7\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-95893\n  Win32k Information\n  Disclosure Vulnerability\n  Important\n  5.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-112727\n  Windows  Domain Name Service Remote Code Execution\n  Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-96002\n  Windows  Domain Name Service Remote Code Execution\n  Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-96020\n  Windows  Domain Name Service Remote Code Execution\n  Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-96064\n  Windows  Domain Name Service Remote Code Execution\n  Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-96092\n  Windows  Domain Name Service Remote Code Execution\n  Vulnerability\n  Important\n  8.1\n  No\n  No\n  3\n  RCE\n \n \n  CVE-2026-96177\n  Windows  Domain Name Service Remote Code Execution\n  Vulnerability\n  Important\n  8.1\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-95884\n  Windows Active\n  Directory Certificate Services Information Disclosure Vulnerability\n  Important\n  5.3\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-105590\n  Windows Active\n  Directory Certificate Services Security Feature Bypass\n  Important\n  5.3\n  No\n  No\n  2\n  SFB\n \n \n  CVE-2026-105559\n  Windows Active\n  Directory Denial of Service Vulnerability\n  Important\n  6.5\n  No\n  No\n  2\n  DoS\n \n \n  CVE-2026-105568\n  Windows Active\n  Directory Domain Services Denial of Service Vulnerability\n  Important\n  6.5\n  No\n  No\n  2\n  DoS\n \n \n  CVE-2026-119948\n  Windows Active\n  Directory Remote Code Execution Vulnerability\n  Important\n  7.5\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-122988\n  Windows Admin Center\n  Elevation of Privilege Vulnerability\n  Important\n  8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-105020\n  Windows Advanced\n  Rasterization Platform Elevation of Privilege Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-105021\n  Windows Advanced\n  Rasterization Platform Elevation of Privilege Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-105022\n  Windows Advanced\n  Rasterization Platform Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-105023\n  Windows Advanced\n  Rasterization Platform Elevation of Privilege Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-105025\n  Windows Advanced\n  Rasterization Platform Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-105026\n  Windows Advanced\n  Rasterization Platform Elevation of Privilege Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-105490\n  Windows Advanced\n  Rasterization Platform Elevation of Privilege Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-105491\n  Windows Advanced\n  Rasterization Platform Elevation of Privilege Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-105493\n  Windows Advanced\n  Rasterization Platform Elevation of Privilege Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-105495\n  Windows Advanced\n  Rasterization Platform Elevation of Privilege Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-105496\n  Windows Advanced\n  Rasterization Platform Elevation of Privilege Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-105497\n  Windows Advanced\n  Rasterization Platform Elevation of Privilege Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-105498\n  Windows Advanced\n  Rasterization Platform Elevation of Privilege Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-105499\n  Windows Advanced\n  Rasterization Platform Elevation of Privilege Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-118215\n  Windows Advanced\n  Rasterization Platform Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-118216\n  Windows Advanced\n  Rasterization Platform Elevation of Privilege Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-118217\n  Windows Advanced\n  Rasterization Platform Elevation of Privilege Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-118218\n  Windows Advanced\n  Rasterization Platform Elevation of Privilege Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-118219\n  Windows Advanced\n  Rasterization Platform Elevation of Privilege Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-118221\n  Windows Advanced\n  Rasterization Platform Elevation of Privilege Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-118222\n  Windows Advanced\n  Rasterization Platform Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-118223\n  Windows Advanced\n  Rasterization Platform Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-118224\n  Windows Advanced\n  Rasterization Platform Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-118225\n  Windows Advanced\n  Rasterization Platform Elevation of Privilege Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-118226\n  Windows Advanced\n  Rasterization Platform Elevation of Privilege Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-118227\n  Windows Advanced\n  Rasterization Platform Elevation of Privilege Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-118228\n  Windows Advanced\n  Rasterization Platform Elevation of Privilege Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-118229\n  Windows Advanced\n  Rasterization Platform Elevation of Privilege Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-118232\n  Windows Advanced\n  Rasterization Platform Elevation of Privilege Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-118277\n  Windows Advanced\n  Rasterization Platform Elevation of Privilege Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-118278\n  Windows Advanced\n  Rasterization Platform Elevation of Privilege Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-118279\n  Windows Advanced\n  Rasterization Platform Elevation of Privilege Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-118280\n  Windows Advanced\n  Rasterization Platform Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-118283\n  Windows Advanced\n  Rasterization Platform Elevation of Privilege Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-94515\n  Windows Advanced\n  Rasterization Platform Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-95960\n  Windows Advanced\n  Rasterization Platform Elevation of Privilege Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-118214\n  Windows Advanced\n  Rasterization Platform Information Disclosure Vulnerability\n  Important\n  6.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-88242\n  Windows Ancillary\n  Function Driver for WinSock Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  1\n  EoP\n \n \n  CVE-2026-95944\n  Windows App Readiness\n  Service Tampering Vulnerability\n  Important\n  5.5\n  No\n  No\n  2\n  Tampering\n \n \n  CVE-2026-96018\n  Windows AppContainer\n  Information Disclosure Vulnerability\n  Important\n  6.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-116714\n  Windows AppX\n  Deployment Service Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  1\n  EoP\n \n \n  CVE-2026-88224\n  Windows AppX\n  Deployment Service Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-96074\n  Windows AppX Package\n  Manager Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-105541\n  Windows Audio Service\n  Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119888\n  Windows Audio Service\n  Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119893\n  Windows Audio Service\n  Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119894\n  Windows Audio Service\n  Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119895\n  Windows Audio Service\n  Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-121671\n  Windows Audio Service\n  Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-96038\n  Windows Audio Service\n  Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-96155\n  Windows Audio Service\n  Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-122175\n  Windows Autopilot\n  Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  1\n  EoP\n \n \n  CVE-2026-105554\n  Windows Background\n  Intelligent Transfer Service (BITS) Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119405\n  Windows Backup Engine\n  Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-70182\n  Windows Bind Filter\n  Driver Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  3\n  EoP\n \n \n  CVE-2026-88239\n  Windows Biometric\n  Service Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-95877\n  Windows Biometric\n  Service Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-96127\n  Windows Biometric\n  Service Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119832\n  Windows BitLocker\n  Security Feature Bypass Vulnerability\n  Important\n  5.9\n  No\n  No\n  2\n  SFB\n \n \n  CVE-2026-97015\n  Windows BitLocker\n  Security Feature Bypass Vulnerability\n  Important\n  6.8\n  No\n  No\n  2\n  SFB\n \n \n  CVE-2026-88187\n  Windows Bluetooth A2DP\n  driver Elevation of Privilege Vulnerability\n  Important\n  8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-95996\n  Windows Bluetooth Port\n  Driver Elevation of Privilege Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-88213\n  Windows Bluetooth\n  Service Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-96001\n  Windows Bluetooth\n  Service Information Disclosure Vulnerability\n  Important\n  5.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-112761\n  Windows Broadcast DVR\n  User Service Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-113762\n  Windows Broadcast DVR\n  User Service Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119401\n  Windows Broadcast DVR\n  User Service Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119402\n  Windows Broadcast DVR\n  User Service Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119403\n  Windows Broadcast DVR\n  User Service Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-88221\n  Windows Broadcast DVR\n  User Service Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-94529\n  Windows Broadcast DVR\n  User Service Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-95871\n  Windows Broadcast DVR\n  User Service Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-96156\n  Windows Broker\n  Infrastructure Service Information Disclosure Vulnerability\n  Important\n  5.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-88245\n  Windows Brokering File\n  System Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-95979\n  Windows Brokering File\n  System Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-96097\n  Windows Brokering File\n  System Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-108405\n  Windows CD-ROM Driver\n  Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-108404\n  Windows CD-ROM Driver\n  Remote Code Execution Vulnerability\n  Important\n  6.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-103571\n  Windows CNG Key\n  Isolation Service Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-105533\n  Windows COM Elevation\n  of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-112968\n  Windows COM Elevation\n  of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-94531\n  Windows COM Elevation\n  of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-113767\n  Windows COM+ Event\n  System Service Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-113769\n  Windows COM+ Event\n  System Service Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119855\n  Windows COM+ Event\n  System Service Information Disclosure Vulnerability\n  Important\n  5.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-85942\n  Windows Camera Frame\n  Server Monitor Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-88232\n  Windows Camera Frame\n  Server Monitor Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-88238\n  Windows Camera Frame\n  Server Monitor Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  1\n  EoP\n \n \n  CVE-2026-118138\n  Windows Client for NFS\n  Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-122165\n  Windows Client for NFS\n  Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-95885\n  Windows Client for NFS\n  Elevation of Privilege Vulnerability\n  Important\n  8.1\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-118141\n  Windows Client for NFS\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  3\n  RCE\n \n \n  CVE-2026-88249\n  Windows Client for NFS\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-119404\n  Windows Client for NFS\n  Security Feature Bypass Vulnerability\n  Important\n  5.9\n  No\n  No\n  2\n  SFB\n \n \n  CVE-2026-96162\n  Windows Clipboard\n  Virtual Channel Extension Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-105569\n  Windows Cloud Files\n  Mini Filter Driver Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-112763\n  Windows Cloud Files\n  Mini Filter Driver Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  3\n  EoP\n \n \n  CVE-2026-112810\n  Windows Cloud Files\n  Mini Filter Driver Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119974\n  Windows Cloud Files\n  Mini Filter Driver Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-112803\n  Windows Cloud Files\n  Mini Filter Driver Information Disclosure Vulnerability\n  Important\n  5.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-112809\n  Windows Composite\n  Image File System Information Disclosure Vulnerability\n  Important\n  5.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-96072\n  Windows Connected User\n  Experiences and Telemetry Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-96088\n  Windows Connected User\n  Experiences and Telemetry Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-96101\n  Windows Connected User\n  Experiences and Telemetry Information Disclosure Vulnerability\n  Important\n  5.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-96042\n  Windows Connection\n  Manager Service Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-96043\n  Windows Connection\n  Manager Service Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-112753\n  Windows Container\n  Isolation FS Filter Driver (unionfs.sys) Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-113761\n  Windows Container\n  Isolation FS Filter Driver (unionfs.sys) Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-113771\n  Windows Container\n  Isolation FS Filter Driver (unionfs.sys) Elevation of Privilege Vulnerability\n  Important\n  5.5\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-105562\n  Windows Container\n  Manager Service Information Disclosure Vulnerability\n  Important\n  4.7\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-119393\n  Windows Credential\n  Manager Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  3\n  EoP\n \n \n  CVE-2026-96978\n  Windows Credential\n  User Interface Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-118739\n  Windows DHCP Client\n  Denial of Service Vulnerability\n  Important\n  6.5\n  No\n  No\n  2\n  DoS\n \n \n  CVE-2026-113863\n  Windows DHCP Client\n  Elevation of Privilege Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-88240\n  Windows DHCP Client\n  Elevation of Privilege Vulnerability\n  Important\n  8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-96115\n  Windows DHCP Client\n  Elevation of Privilege Vulnerability\n  Important\n  8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119890\n  Windows DHCP Server\n  Denial of Service Vulnerability\n  Important\n  5.3\n  No\n  No\n  2\n  DoS\n \n \n  CVE-2026-96134\n  Windows DHCP Server\n  Denial of Service Vulnerability\n  Important\n  7.5\n  No\n  No\n  2\n  DoS\n \n \n  CVE-2026-105588\n  Windows DHCP Server\n  Elevation of Privilege Vulnerability\n  Important\n  6.4\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-105557\n  Windows DHCP Server\n  Information Disclosure Vulnerability\n  Important\n  5.9\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-105560\n  Windows DHCP Server\n  Remote Code Execution Vulnerability\n  Important\n  7.2\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-72998\n  Windows DHCP Server\n  Remote Code Execution Vulnerability\n  Important\n  8.1\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-88216\n  Windows DHCP Server\n  Remote Code Execution Vulnerability\n  Important\n  7.5\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-88243\n  Windows DHCP Server\n  Remote Code Execution Vulnerability\n  Important\n  9.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-113773\n  Windows DHCP Server\n  Spoofing Vulnerability\n  Important\n  5.3\n  No\n  No\n  2\n  Spoofing\n \n \n  CVE-2026-96076\n  Windows DIAL Client\n  Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-96176\n  Windows DNS Denial of\n  Service Vulnerability\n  Important\n  7.5\n  No\n  No\n  2\n  DoS\n \n \n  CVE-2026-96983\n  Windows DNS Denial of\n  Service Vulnerability\n  Important\n  5.3\n  No\n  No\n  3\n  DoS\n \n \n  CVE-2026-105520\n  Windows DNS Elevation\n  of Privilege Vulnerability\n  Important\n  7.2\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119953\n  Windows DNS Elevation\n  of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-96179\n  Windows DNS Elevation\n  of Privilege Vulnerability\n  Important\n  6.7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-105579\n  Windows DNS\n  Information Disclosure Vulnerability\n  Important\n  7.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-108425\n  Windows DNS\n  Information Disclosure Vulnerability\n  Important\n  5.9\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-119970\n  Windows DNS\n  Information Disclosure Vulnerability\n  Important\n  4.9\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-96970\n  Windows DNS\n  Information Disclosure Vulnerability\n  Important\n  4.9\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-96976\n  Windows DNS\n  Information Disclosure Vulnerability\n  Important\n  4.9\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-96980\n  Windows DNS\n  Information Disclosure Vulnerability\n  Important\n  4.9\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-96984\n  Windows DNS\n  Information Disclosure Vulnerability\n  Important\n  4.9\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-96985\n  Windows DNS\n  Information Disclosure Vulnerability\n  Important\n  4.9\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-96986\n  Windows DNS\n  Information Disclosure Vulnerability\n  Important\n  4.9\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-96987\n  Windows DNS\n  Information Disclosure Vulnerability\n  Important\n  4.9\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-96988\n  Windows DNS\n  Information Disclosure Vulnerability\n  Important\n  4.9\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-97006\n  Windows DNS\n  Information Disclosure Vulnerability\n  Important\n  4.9\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-109463\n  Windows DNS Remote\n  Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-113855\n  Windows DNS Remote\n  Code Execution Vulnerability\n  Important\n  7.5\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-88218\n  Windows DNS Remote\n  Code Execution Vulnerability\n  Important\n  9.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-119971\n  Windows DNS Server\n  Information Disclosure Vulnerability\n  Important\n  4.9\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-96112\n  Windows DNS Server\n  Information Disclosure Vulnerability\n  Important\n  5.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-96972\n  Windows DNS Server\n  Information Disclosure Vulnerability\n  Important\n  7.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-81384\n  Windows DNS Server\n  Remote Code Execution Vulnerability\n  Important\n  8.1\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-119905\n  Windows DNS Spoofing\n  Vulnerability\n  Important\n  4.9\n  No\n  No\n  2\n  Spoofing\n \n \n  CVE-2026-113763\n  Windows DPAPI (Data\n  Protection Application Programming Interface) Elevation of Privilege\n  Vulnerability\n  Important\n  6.3\n  No\n  No\n  3\n  EoP\n \n \n  CVE-2026-105575\n  Windows DWM Core\n  Library Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-105582\n  Windows DWM Core\n  Library Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-105583\n  Windows DWM Core\n  Library Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-112986\n  Windows DWM Core\n  Library Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-112758\n  Windows Defender\n  Firewall Service Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-112977\n  Windows Deployment\n  Services Information Disclosure Vulnerability\n  Important\n  5.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-113818\n  Windows Deployment\n  Services Information Disclosure Vulnerability\n  Important\n  6.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-118213\n  Windows Deployment\n  Services Information Disclosure Vulnerability\n  Important\n  5.9\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-105558\n  Windows Deployment\n  Services Remote Code Execution Vulnerability\n  Important\n  7.5\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-112988\n  Windows Desktop Window\n  Manager Elevation of Privilege Vulnerability\n  Important\n  5.5\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-113758\n  Windows Desktop Window\n  Manager Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-112743\n  Windows Device\n  Association Service Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119844\n  Windows Device\n  Association Service Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119866\n  Windows Device\n  Association Service Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119874\n  Windows Device\n  Association Service Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-113750\n  Windows Device\n  Inventory Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-113817\n  Windows Devices Human\n  Interface Elevation of Privilege Vulnerability\n  Important\n  6.6\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-112800\n  Windows Diagnostic\n  Policy Service Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-95934\n  Windows Diagnostic\n  Policy Service Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-95976\n  Windows Diagnostic\n  Policy Service Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-118142\n  Windows Distributed\n  File System (DFS) Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119917\n  Windows Distributed\n  Transaction Coordinator Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119919\n  Windows Distributed\n  Transaction Coordinator Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-105527\n  Windows Encrypting\n  File System (EFS) Denial of Service Vulnerability\n  Important\n  5.5\n  No\n  No\n  2\n  DoS\n \n \n  CVE-2026-96973\n  Windows Encrypting\n  File System (EFS) Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119394\n  Windows Enhanced\n  Storage Remote Code Execution Vulnerability\n  Important\n  6.6\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-105540\n  Windows Error\n  Reporting Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-85862\n  Windows Error\n  Reporting Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  3\n  EoP\n \n \n  CVE-2026-94525\n  Windows Error\n  Reporting Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-95947\n  Windows Error\n  Reporting Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-96153\n  Windows Error\n  Reporting Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-112793\n  Windows Event\n  Collector Service Elevation of Privilege Vulnerability\n  Important\n  7.5\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-112796\n  Windows Event\n  Collector Service Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-95997\n  Windows Event Logging\n  Service Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-95977\n  Windows Event Viewer\n  Information Disclosure Vulnerability\n  Important\n  5.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-118137\n  Windows FTP Service\n  Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119869\n  Windows Failover\n  Cluster Elevation of Privilege Vulnerability\n  Important\n  6.4\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-113751\n  Windows Fast FAT\n  Driver Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-96075\n  Windows Feedback Hub\n  Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-108415\n  Windows File Server\n  Resource Management Service Elevation of Privilege Vulnerability\n  Important\n  6.8\n  No\n  No\n  3\n  EoP\n \n \n  CVE-2026-108416\n  Windows File Server\n  Resource Management Service Elevation of Privilege Vulnerability\n  Important\n  6.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-108421\n  Windows File Server\n  Resource Management Service Elevation of Privilege Vulnerability\n  Important\n  7.5\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-113765\n  Windows File Server\n  Resource Management Service Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-113754\n  Windows FileCrypt\n  Driver Information Disclosure Vulnerability\n  Important\n  4.7\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-113757\n  Windows FileCrypt\n  Driver Information Disclosure Vulnerability\n  Important\n  5.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-113756\n  Windows FileCrypt\n  Driver Security Feature Bypass Vulnerability\n  Important\n  5.3\n  No\n  No\n  2\n  SFB\n \n \n  CVE-2026-113755\n  Windows Filter Manager\n  Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-121673\n  Windows Filter Manager\n  Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-105553\n  Windows Filtering\n  Platform (WFP) Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-112756\n  Windows Filtering\n  Platform (WFP) Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-88215\n  Windows Filtering\n  Platform (WFP) Elevation of Privilege Vulnerability\n  Important\n  6.4\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119907\n  Windows Function\n  Discovery Resource Publication Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-108407\n  Windows GDI Elevation\n  of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-94527\n  Windows GDI Elevation\n  of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-108424\n  Windows GDI\n  Information Disclosure Vulnerability\n  Important\n  6.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-94519\n  Windows Graphics\n  Kernel Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-95879\n  Windows Graphics\n  Kernel Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-95888\n  Windows Graphics\n  Kernel Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-95895\n  Windows Graphics\n  Kernel Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-95906\n  Windows Graphics\n  Kernel Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-95909\n  Windows Graphics\n  Kernel Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-95922\n  Windows Graphics\n  Kernel Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-95932\n  Windows Graphics\n  Kernel Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-95935\n  Windows Graphics\n  Kernel Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  1\n  EoP\n \n \n  CVE-2026-95938\n  Windows Graphics\n  Kernel Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-95942\n  Windows Graphics\n  Kernel Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-95948\n  Windows Graphics\n  Kernel Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-95950\n  Windows Graphics\n  Kernel Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-95953\n  Windows Graphics\n  Kernel Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-95966\n  Windows Graphics\n  Kernel Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-95971\n  Windows Graphics\n  Kernel Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-95973\n  Windows Graphics\n  Kernel Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-95974\n  Windows Graphics\n  Kernel Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-95983\n  Windows Graphics\n  Kernel Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  1\n  EoP\n \n \n  CVE-2026-95991\n  Windows Graphics\n  Kernel Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-96122\n  Windows Graphics\n  Kernel Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-96124\n  Windows Graphics\n  Kernel Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-96126\n  Windows Graphics\n  Kernel Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  1\n  EoP\n \n \n  CVE-2026-96160\n  Windows Graphics\n  Kernel Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-96168\n  Windows Graphics\n  Kernel Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-96171\n  Windows Graphics\n  Kernel Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119841\n  Windows Graphics\n  Kernel Information Disclosure Vulnerability\n  Important\n  4.7\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-88217\n  Windows Graphics\n  Kernel Information Disclosure Vulnerability\n  Important\n  5.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-95946\n  Windows Graphics\n  Kernel Information Disclosure Vulnerability\n  Important\n  5.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-96048\n  Windows Graphics\n  Kernel Information Disclosure Vulnerability\n  Important\n  4.7\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-96133\n  Windows Graphics\n  Kernel Information Disclosure Vulnerability\n  Important\n  5.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-96137\n  Windows Graphics\n  Kernel Information Disclosure Vulnerability\n  Important\n  5.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-96144\n  Windows Graphics\n  Kernel Information Disclosure Vulnerability\n  Important\n  4.7\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-119992\n  Windows HTTP.sys\n  Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  1\n  EoP\n \n \n  CVE-2026-95923\n  Windows HTTP.sys\n  Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119385\n  Windows Hyper-V Denial\n  of Service Vulnerability\n  Important\n  4.7\n  No\n  No\n  2\n  DoS\n \n \n  CVE-2026-119955\n  Windows Hyper-V Denial\n  of Service Vulnerability\n  Important\n  6\n  No\n  No\n  2\n  DoS\n \n \n  CVE-2026-95913\n  Windows Hyper-V Denial\n  of Service Vulnerability\n  Important\n  5.9\n  No\n  No\n  2\n  DoS\n \n \n  CVE-2026-96965\n  Windows Hyper-V Denial\n  of Service Vulnerability\n  Important\n  5.3\n  No\n  No\n  2\n  DoS\n \n \n  CVE-2026-119391\n  Windows Hyper-V\n  Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119826\n  Windows Hyper-V\n  Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-95910\n  Windows Hyper-V\n  Security Feature Bypass Vulnerability\n  Important\n  6.7\n  No\n  No\n  2\n  SFB\n \n \n  CVE-2026-119959\n  Windows Hyper-V\n  Spoofing Vulnerability\n  Important\n  5.3\n  No\n  No\n  2\n  Spoofing\n \n \n  CVE-2026-122169\n  Windows IKE Extension\n  Spoofing Vulnerability\n  Important\n  7.5\n  No\n  No\n  2\n  Spoofing\n \n \n  CVE-2026-119871\n  Windows IP Translation\n  Configuration Service Elevation of Privilege Vulnerability\n  Important\n  6.4\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-122163\n  Windows Image\n  Acquisition Remote Code Execution Vulnerability\n  Important\n  7.5\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-96164\n  Windows Imaging\n  Component Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-119862\n  Windows Input System\n  Elevation of Privilege Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119916\n  Windows Input System\n  Elevation of Privilege Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-105501\n  Windows Installer\n  Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  1\n  EoP\n \n \n  CVE-2026-105507\n  Windows Installer\n  Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-105532\n  Windows Installer\n  Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-105543\n  Windows Installer\n  Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-105545\n  Windows Installer\n  Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-113847\n  Windows Installer\n  Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119398\n  Windows Installer\n  Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  1\n  EoP\n \n \n  CVE-2026-119399\n  Windows Installer\n  Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119831\n  Windows Installer\n  Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119852\n  Windows Installer\n  Elevation of Privilege Vulnerability\n  Important\n  6.7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119865\n  Windows Installer\n  Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119892\n  Windows Installer\n  Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  1\n  EoP\n \n \n  CVE-2026-119903\n  Windows Installer\n  Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  1\n  EoP\n \n \n  CVE-2026-119929\n  Windows Installer\n  Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-95951\n  Windows Installer\n  Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-96004\n  Windows Installer\n  Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-96008\n  Windows Installer\n  Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-96019\n  Windows Installer\n  Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-96026\n  Windows Installer\n  Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-96027\n  Windows Installer\n  Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-96028\n  Windows Installer\n  Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-96029\n  Windows Installer\n  Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-96035\n  Windows Installer\n  Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-96036\n  Windows Installer\n  Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-96046\n  Windows Installer\n  Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-96047\n  Windows Installer\n  Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-96060\n  Windows Installer\n  Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-96061\n  Windows Installer\n  Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-96062\n  Windows Installer\n  Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-96073\n  Windows Installer\n  Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-96085\n  Windows Installer\n  Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-96152\n  Windows Installer\n  Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-112789\n  Windows Installer\n  Information Disclosure Vulnerability\n  Important\n  4.7\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-119838\n  Windows Installer\n  Information Disclosure Vulnerability\n  Important\n  4.7\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-119887\n  Windows Installer\n  Information Disclosure Vulnerability\n  Important\n  6.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-119867\n  Windows Installer\n  Security Feature Bypass Vulnerability\n  Important\n  5.3\n  No\n  No\n  2\n  SFB\n \n \n  CVE-2026-96093\n  Windows Internet\n  (wininet.dll) Information Disclosure Vulnerability\n  Important\n  4.7\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-118124\n  Windows Internet\n  Connection Sharing (ICS) Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119859\n  Windows Internet\n  Connection Sharing (ICS) Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119860\n  Windows Internet\n  Connection Sharing (ICS) Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119861\n  Windows Internet\n  Connection Sharing (ICS) Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-122179\n  Windows Internet\n  Connection Sharing (ICS) Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119909\n  Windows Internet\n  Information Services Denial of Service Vulnerability\n  Important\n  5.9\n  No\n  No\n  2\n  DoS\n \n \n  CVE-2026-119936\n  Windows Internet\n  Information Services Denial of Service Vulnerability\n  Important\n  5.9\n  No\n  No\n  2\n  DoS\n \n \n  CVE-2026-105584\n  Windows Inventory\n  Backup Information Disclosure Vulnerability\n  Important\n  5.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-112985\n  Windows JScript Remote\n  Code Execution Vulnerability\n  Important\n  7.5\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-119940\n  Windows Kerberos\n  Denial of Service Vulnerability\n  Important\n  6.5\n  No\n  No\n  3\n  DoS\n \n \n  CVE-2026-70240\n  Windows Kerberos\n  Denial of Service Vulnerability\n  Important\n  7.5\n  No\n  No\n  2\n  DoS\n \n \n  CVE-2026-96082\n  Windows Kerberos\n  Denial of Service Vulnerability\n  Important\n  6.5\n  No\n  No\n  2\n  DoS\n \n \n  CVE-2026-119847\n  Windows Kerberos\n  Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-122164\n  Windows Kerberos\n  Elevation of Privilege Vulnerability\n  Important\n  8\n  No\n  No\n  3\n  EoP\n \n \n  CVE-2026-85844\n  Windows Kerberos\n  Elevation of Privilege Vulnerability\n  Important\n  9.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-105504\n  Windows Kernel\n  Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-105513\n  Windows Kernel\n  Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-105566\n  Windows Kernel\n  Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-108403\n  Windows Kernel\n  Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-109473\n  Windows Kernel\n  Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  1\n  EoP\n \n \n  CVE-2026-112790\n  Windows Kernel\n  Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  3\n  EoP\n \n \n  CVE-2026-112802\n  Windows Kernel\n  Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-112805\n  Windows Kernel\n  Elevation of Privilege Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-112969\n  Windows Kernel\n  Elevation of Privilege Vulnerability\n  Important\n  6.6\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-114170\n  Windows Kernel\n  Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-118143\n  Windows Kernel\n  Elevation of Privilege Vulnerability\n  Important\n  6.8\n  No\n  No\n  3\n  EoP\n \n \n  CVE-2026-119868\n  Windows Kernel\n  Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119884\n  Windows Kernel\n  Elevation of Privilege Vulnerability\n  Important\n  6.8\n  No\n  No\n  3\n  EoP\n \n \n  CVE-2026-119912\n  Windows Kernel\n  Elevation of Privilege Vulnerability\n  Important\n  6.7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119918\n  Windows Kernel\n  Elevation of Privilege Vulnerability\n  Important\n  6.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119935\n  Windows Kernel\n  Elevation of Privilege Vulnerability\n  Important\n  6.8\n  No\n  No\n  3\n  EoP\n \n \n  CVE-2026-119965\n  Windows Kernel\n  Elevation of Privilege Vulnerability\n  Important\n  6.4\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-122183\n  Windows Kernel\n  Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-94514\n  Windows Kernel\n  Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  1\n  EoP\n \n \n  CVE-2026-95905\n  Windows Kernel\n  Elevation of Privilege Vulnerability\n  Important\n  6.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-95988\n  Windows Kernel\n  Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  1\n  EoP\n \n \n  CVE-2026-96031\n  Windows Kernel\n  Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-96052\n  Windows Kernel\n  Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  3\n  EoP\n \n \n  CVE-2026-96129\n  Windows Kernel\n  Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  3\n  EoP\n \n \n  CVE-2026-105552\n  Windows Kernel\n  Information Disclosure Vulnerability\n  Important\n  5.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-119857\n  Windows Kernel\n  Information Disclosure Vulnerability\n  Important\n  5.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-96058\n  Windows Kernel\n  Information Disclosure Vulnerability\n  Important\n  4.6\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-112973\n  Windows Kernel\n  Security Feature Bypass Vulnerability\n  Important\n  7.1\n  No\n  No\n  2\n  SFB\n \n \n  CVE-2026-119397\n  Windows Kernel\n  Transaction Manager Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-94522\n  Windows Kernel\n  Transaction Manager Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-122297\n  Windows Kernel\n  Transaction Manager Information Disclosure Vulnerability\n  Important\n  5.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-94517\n  Windows Kernel\n  Transaction Manager Information Disclosure Vulnerability\n  Important\n  5.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-96139\n  Windows Kernel-Mode\n  Drivers Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-88230\n  Windows LUA File\n  Virtualization Filter Driver Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  1\n  EoP\n \n \n  CVE-2026-96117\n  Windows LUA File\n  Virtualization Filter Driver Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-113766\n  Windows Language\n  Experience Service Tampering Vulnerability\n  Important\n  3.3\n  No\n  No\n  2\n  Tampering\n \n \n  CVE-2026-108402\n  Windows Layer-2 Bridge\n  Network Driver Denial of Service Vulnerability\n  Important\n  5.3\n  No\n  No\n  3\n  DoS\n \n \n  CVE-2026-116707\n  Windows Link Layer\n  Topology Discovery Protocol Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-116706\n  Windows Link Layer\n  Topology Discovery Protocol Remote Code Execution Vulnerability\n  Important\n  7.5\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-88244\n  Windows Link Layer\n  Topology Discovery Protocol Remote Code Execution Vulnerability\n  Important\n  7.5\n  No\n  No\n  3\n  RCE\n \n \n  CVE-2026-112975\n  Windows Link-Layer\n  Discovery Protocol (LLDP) Denial of Service Vulnerability\n  Important\n  5.3\n  No\n  No\n  2\n  DoS\n \n \n  CVE-2026-113816\n  Windows Link-Layer\n  Discovery Protocol (LLDP) Elevation of Privilege Vulnerability\n  Important\n  4.1\n  No\n  No\n  3\n  EoP\n \n \n  CVE-2026-112807\n  Windows Local Security\n  Authority Subsystem Service (LSASS) Denial of Service Vulnerability\n  Important\n  6.5\n  No\n  No\n  2\n  DoS\n \n \n  CVE-2026-70231\n  Windows Local Security\n  Authority Subsystem Service (LSASS) Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-85801\n  Windows Local Security\n  Authority Subsystem Service (LSASS) Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-88227\n  Windows Local Security\n  Authority Subsystem Service (LSASS) Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-88228\n  Windows Local Security\n  Authority Subsystem Service (LSASS) Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-96016\n  Windows Local Security\n  Authority Subsystem Service (LSASS) Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-96066\n  Windows Local Security\n  Authority Subsystem Service (LSASS) Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-95876\n  Windows Local Session\n  Manager (LSM) Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-105565\n  Windows MIDI Service\n  Module Elevation of Privileges Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-105574\n  Windows MIDI Service\n  Module Elevation of Privileges Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119901\n  Windows MIDI Service\n  Module Elevation of Privileges Vulnerability\n  Important\n  6.4\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-105503\n  Windows Management\n  Instrumentation Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-105524\n  Windows Management\n  Instrumentation Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  1\n  EoP\n \n \n  CVE-2026-105546\n  Windows Management\n  Instrumentation Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-112814\n  Windows Management\n  Instrumentation Elevation of Privilege Vulnerability\n  Important\n  5.5\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-95920\n  Windows Management\n  Instrumentation Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-108410\n  Windows Management\n  Instrumentation Information Disclosure Vulnerability\n  Important\n  5.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-112965\n  Windows Management\n  Instrumentation Information Disclosure Vulnerability\n  Important\n  5.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-105580\n  Windows Management\n  Instrumentation Remote Code Execution Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-119836\n  Windows Management\n  Services Information Disclosure Vulnerability\n  Important\n  4.7\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-122182\n  Windows Maps Elevation\n  of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-88229\n  Windows Media Player\n  Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-105515\n  Windows Message\n  Queuing Denial of Service Vulnerability\n  Important\n  7.5\n  No\n  No\n  2\n  DoS\n \n \n  CVE-2026-119848\n  Windows Message\n  Queuing Denial of Service Vulnerability\n  Important\n  5.3\n  No\n  No\n  2\n  DoS\n \n \n  CVE-2026-118125\n  Windows Message\n  Queuing Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-118126\n  Windows Message\n  Queuing Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119833\n  Windows Message\n  Queuing Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119816\n  Windows Microsoft\n  Account Sign-in Assistant Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  3\n  EoP\n \n \n  CVE-2026-119921\n  Windows Microsoft\n  Account Sign-in Assistant Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119944\n  Windows Mobile Device\n  Management Elevation of Privilege Vulnerability\n  Important\n  7.5\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-112987\n  Windows Modern Device\n  Management (MDM) Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-113820\n  Windows Modern Device\n  Management (MDM) Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-96184\n  Windows Modern Device\n  Management (MDM) Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-102219\n  Windows Modern Device\n  Management (MDM) Remote Code Execution Vulnerability\n  Important\n  8.1\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-119945\n  Windows Modern Device\n  Management (MDM) Remote Code Execution Vulnerability\n  Important\n  8.1\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-118220\n  Windows Multiple\n  Provider Router Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-100223\n  Windows NTFS Elevation\n  of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119900\n  Windows NTFS Elevation\n  of Privilege Vulnerability\n  Important\n  7.3\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119933\n  Windows NTFS Elevation\n  of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-105542\n  Windows NTFS Remote\n  Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  3\n  RCE\n \n \n  CVE-2026-113848\n  Windows NTFS Remote\n  Code Execution Vulnerability\n  Important\n  7.8\n  No\n  No\n  3\n  RCE\n \n \n  CVE-2026-102200\n  Windows NTFS Tampering\n  Vulnerability\n  Important\n  4.7\n  No\n  No\n  2\n  Tampering\n \n \n  CVE-2026-113844\n  Windows NTFS Tampering\n  Vulnerability\n  Important\n  5.5\n  No\n  No\n  2\n  Tampering\n \n \n  CVE-2026-121680\n  Windows NTLM Spoofing\n  Vulnerability\n  Important\n  7.5\n  No\n  No\n  2\n  Spoofing\n \n \n  CVE-2026-105551\n  Windows NetBIOS\n  Elevation of Privilege Vulnerability\n  Important\n  7.5\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-112798\n  Windows NetBIOS\n  Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  1\n  EoP\n \n \n  CVE-2026-119873\n  Windows NetBIOS\n  Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-96971\n  Windows NetBIOS\n  Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-88212\n  Windows Network\n  Address Translation (NAT) Remote Code Execution Vulnerability\n  Important\n  7.5\n  No\n  No\n  3\n  RCE\n \n \n  CVE-2026-105525\n  Windows Network\n  Connection Broker Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-108406\n  Windows Network\n  Connection Broker Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119821\n  Windows Network\n  Connection Broker Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-118736\n  Windows Network File\n  System Information Disclosure Vulnerability\n  Important\n  5.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-105587\n  Windows OLE DB\n  Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-95933\n  Windows OLE Elevation\n  of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-96110\n  Windows OLE\n  Information Disclosure Vulnerability\n  Important\n  5.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-112760\n  Windows Overlay Filter\n  Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-112813\n  Windows Overlay Filter\n  Elevation of Privilege Vulnerability\n  Important\n  4.7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119822\n  Windows Overlay Filter\n  Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-121670\n  Windows Overlay Filter\n  Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-108409\n  Windows Overlay Filter\n  Information Disclosure Vulnerability\n  Important\n  5.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-112750\n  Windows Overlay Filter\n  Information Disclosure Vulnerability\n  Important\n  5.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-96981\n  Windows PCI Bus Driver\n  Elevation of Privilege Vulnerability\n  Important\n  6.4\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-96992\n  Windows PCI Bus Driver\n  Elevation of Privilege Vulnerability\n  Important\n  6.4\n  No\n  No\n  3\n  EoP\n \n \n  CVE-2026-105018\n  Windows Partition\n  Management Driver Elevation of Privilege Vulnerability\n  Important\n  6.6\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-88220\n  Windows Performance\n  Counters Information Disclosure Vulnerability\n  Important\n  5.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-113768\n  Windows Performance\n  Counters Remote Code Execution Vulnerability\n  Important\n  7.5\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-95975\n  Windows Performance\n  Counters Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-96993\n  Windows Performance\n  Monitor Remote Code Execution Vulnerability\n  Important\n  7.5\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-96107\n  Windows Phone Service\n  Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-105511\n  Windows Point-to-Point\n  Protocol over Ethernet (PPPoE) Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-118123\n  Windows Point-to-Point\n  Protocol over Ethernet (PPPoE) Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-124225\n  Windows PowerShell\n  Remote Code Execution Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-105567\n  Windows Print Spooler\n  Components Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-112752\n  Windows Print Spooler\n  Components Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-112762\n  Windows Print Spooler\n  Components Elevation of Privilege Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-112765\n  Windows Print Spooler\n  Components Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-112791\n  Windows Print Spooler\n  Components Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  1\n  EoP\n \n \n  CVE-2026-112792\n  Windows Print Spooler\n  Components Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-112797\n  Windows Print Spooler\n  Components Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-112811\n  Windows Print Spooler\n  Components Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  1\n  EoP\n \n \n  CVE-2026-112976\n  Windows Print Spooler\n  Components Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-112978\n  Windows Print Spooler\n  Components Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-112980\n  Windows Print Spooler\n  Components Elevation of Privilege Vulnerability\n  Important\n  6.7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-112981\n  Windows Print Spooler\n  Components Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-113770\n  Windows Print Spooler\n  Components Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119913\n  Windows Print Spooler\n  Components Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119939\n  Windows Print Spooler\n  Components Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119950\n  Windows Print Spooler\n  Components Elevation of Privilege Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-105531\n  Windows Print Spooler\n  Components Information Disclosure Vulnerability\n  Important\n  5.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-112806\n  Windows Print Spooler\n  Components Information Disclosure Vulnerability\n  Important\n  4.7\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-112808\n  Windows Print Spooler\n  Components Information Disclosure Vulnerability\n  Important\n  6.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-119898\n  Windows\n  PrintWorkflowUserSvc Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119928\n  Windows\n  PrintWorkflowUserSvc Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-123388\n  Windows Program\n  Compatibility Assistant Service Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-88247\n  Windows Program\n  Compatibility Assistant Service Information Disclosure Vulnerability\n  Important\n  5.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-112799\n  Windows Projected File\n  System Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-108414\n  Windows Projected File\n  System Filter Driver Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-113764\n  Windows Projected File\n  System Information Disclosure Vulnerability\n  Important\n  4.7\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-96023\n  Windows Push\n  Notification Core Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-95881\n  Windows Push\n  Notifications Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-112755\n  Windows RNDIS\n  Elevation of Privilege Vulnerability\n  Important\n  6.8\n  No\n  No\n  3\n  EoP\n \n \n  CVE-2026-113772\n  Windows Redirected\n  Drive Buffering Information Disclosure Vulnerability\n  Important\n  4.7\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-108412\n  Windows Redirected\n  Drive Buffering System Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119396\n  Windows Remote Access\n  API Tampering Vulnerability\n  Important\n  6.5\n  No\n  No\n  2\n  Tampering\n \n \n  CVE-2026-113843\n  Windows Remote Access\n  Connection Manager Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-112751\n  Windows Remote\n  Assistance Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119839\n  Windows Remote Desktop\n  Client Elevation of Privilege Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-108417\n  Windows Remote Desktop\n  Client Information Disclosure Vulnerability\n  Important\n  6.5\n  No\n  No\n  3\n  Info\n \n \n  CVE-2026-108418\n  Windows Remote Desktop\n  Client Information Disclosure Vulnerability\n  Important\n  6.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-108419\n  Windows Remote Desktop\n  Client Information Disclosure Vulnerability\n  Important\n  6.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-121677\n  Windows Remote Desktop\n  Client Information Disclosure Vulnerability\n  Important\n  6.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-121678\n  Windows Remote Desktop\n  Client Information Disclosure Vulnerability\n  Important\n  5.3\n  No\n  No\n  3\n  Info\n \n \n  CVE-2026-95908\n  Windows Remote Desktop\n  Client Information Disclosure Vulnerability\n  Important\n  5.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-119932\n  Windows Remote Desktop\n  Denial of Service Vulnerability\n  Important\n  7.5\n  No\n  No\n  2\n  DoS\n \n \n  CVE-2026-122166\n  Windows Remote Desktop\n  Services Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119882\n  Windows Remote Desktop\n  Services Information Disclosure Vulnerability\n  Important\n  5.3\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-69327\n  Windows Remote Desktop\n  Services Remote Code Execution Vulnerability\n  Important\n  7.4\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-69565\n  Windows Remote Desktop\n  Services Remote Code Execution Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-105509\n  Windows Resilient File\n  System (ReFS) Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  3\n  EoP\n \n \n  CVE-2026-119386\n  Windows Resilient File\n  System (ReFS) Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  3\n  EoP\n \n \n  CVE-2026-96081\n  Windows Rich Text Edit\n  Control Remote Code Execution Vulnerability\n  Important\n  7.5\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-112812\n  Windows SMB Client\n  Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-112970\n  Windows SMB Client\n  Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  1\n  EoP\n \n \n  CVE-2026-112971\n  Windows SMB Client\n  Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119870\n  Windows SMB Client\n  Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119988\n  Windows SMB Remote\n  Code Execution Vulnerability\n  Important\n  7.1\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-122176\n  Windows SMB Remote\n  Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-112972\n  Windows SMBv3 Server\n  Remote Code Execution Vulnerability\n  Important\n  7.5\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-119906\n  Windows Sandbox\n  Elevation of Privilege Vulnerability\n  Important\n  \n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-112757\n  Windows Secure Kernel\n  Mode Information Disclosure Vulnerability\n  Important\n  6\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-105561\n  Windows Secure Socket\n  Tunneling Protocol (SSTP) Denial of Service Vulnerability\n  Important\n  7.5\n  No\n  No\n  2\n  DoS\n \n \n  CVE-2026-105510\n  Windows Secure Socket\n  Tunneling Protocol (SSTP) Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-112795\n  Windows Security\n  Account Manager Denial of Service Vulnerability\n  Important\n  6.5\n  No\n  No\n  2\n  DoS\n \n \n  CVE-2026-112966\n  Windows Security\n  Account Manager Denial of Service Vulnerability\n  Important\n  7.5\n  No\n  No\n  2\n  DoS\n \n \n  CVE-2026-122474\n  Windows Security\n  Account Manager Remote Protocol Security Feature Bypass Vulnerability\n  Important\n  5.9\n  No\n  No\n  2\n  SFB\n \n \n  CVE-2026-113842\n  Windows Security\n  Center Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-88241\n  Windows Sensor Data\n  Service Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-112989\n  Windows Servicing\n  Stack Updates Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-105547\n  Windows Setup and\n  Deployment Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119914\n  Windows Setup and\n  Deployment Elevation of Privilege Vulnerability\n  Important\n  6.7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119817\n  Windows Shell\n  Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-97013\n  Windows Shell\n  Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  1\n  EoP\n \n \n  CVE-2026-102868\n  Windows Shell\n  Information Disclosure Vulnerability\n  Important\n  5.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-105506\n  Windows Shell\n  Information Disclosure Vulnerability\n  Important\n  5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-119938\n  Windows Shell Remote\n  Code Execution Vulnerability\n  Important\n  7.5\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-85907\n  Windows Simple Search\n  and Discovery Protocol (SSDP) Service Elevation of Privilege Vulnerability\n  Important\n  4.4\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-112794\n  Windows Smart Card\n  Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-118144\n  Windows Smart Card\n  Elevation of Privilege Vulnerability\n  Important\n  6.6\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119383\n  Windows Smart Card\n  Elevation of Privilege Vulnerability\n  Important\n  6.6\n  No\n  No\n  3\n  EoP\n \n \n  CVE-2026-119835\n  Windows Smart Card\n  Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-95968\n  Windows Smart Card\n  Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-105549\n  Windows Smart Card\n  Information Disclosure Vulnerability\n  Important\n  4.3\n  No\n  No\n  3\n  Info\n \n \n  CVE-2026-112979\n  Windows State\n  Repository Service Tampering Vulnerability\n  Important\n  5.5\n  No\n  No\n  2\n  Tampering\n \n \n  CVE-2026-95998\n  Windows\n  StateRepository API Tampering Vulnerability\n  Important\n  4.4\n  No\n  No\n  2\n  Tampering\n \n \n  CVE-2026-105529\n  Windows Storage\n  Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119389\n  Windows Storage\n  Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  1\n  EoP\n \n \n  CVE-2026-95889\n  Windows Storage\n  Elevation of Privilege Vulnerability\n  Important\n  6.6\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-105534\n  Windows Storage Remote\n  Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-105024\n  Windows Storage Spaces\n  Controller Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119392\n  Windows Storage Spaces\n  Controller Elevation of Privilege Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119851\n  Windows Storage Spaces\n  Controller Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-113814\n  Windows Storage Spaces\n  Controller Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-119908\n  Windows Storage Spaces\n  Controller Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-122475\n  Windows Storage Spaces\n  Controller Remote Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-119830\n  Windows Storport\n  Miniport Driver Elevation of Privilege Vulnerability\n  Important\n  6.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119885\n  Windows Storport\n  Miniport Driver Elevation of Privilege Vulnerability\n  Important\n  6.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119875\n  Windows Storport\n  Miniport Driver Information Disclosure Vulnerability\n  Important\n  4\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-119823\n  Windows Storport\n  Miniport Driver Remote Code Execution Vulnerability\n  Important\n  6.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-119834\n  Windows Subsystem for\n  Linux Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119846\n  Windows Subsystem for\n  Linux Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  3\n  EoP\n \n \n  CVE-2026-88237\n  Windows Subsystem for\n  Linux Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-105530\n  Windows System Events\n  Broker Information Disclosure Vulnerability\n  Important\n  5.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-96077\n  Windows TCP/IP Denial\n  of Service Vulnerability\n  Important\n  7.5\n  No\n  No\n  1\n  DoS\n \n \n  CVE-2026-96102\n  Windows TCP/IP\n  Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-96969\n  Windows TCP/IP\n  Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-112759\n  Windows Task Scheduler\n  Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  1\n  EoP\n \n \n  CVE-2026-122174\n  Windows Task Scheduler\n  Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-88233\n  Windows Task Scheduler\n  Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-95894\n  Windows Task Scheduler\n  Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-96053\n  Windows Task Scheduler\n  Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-96845\n  Windows Task Scheduler\n  Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-108413\n  Windows Telephony\n  Service Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-116700\n  Windows Telephony\n  Service Elevation of Privilege Vulnerability\n  Important\n  6.6\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119886\n  Windows Telephony\n  Service Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  1\n  EoP\n \n \n  CVE-2026-108408\n  Windows Telephony\n  Service Information Disclosure Vulnerability\n  Important\n  5.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-119818\n  Windows Text Services\n  Framework Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  1\n  EoP\n \n \n  CVE-2026-119925\n  Windows Text Services\n  Framework Elevation of Privilege Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119931\n  Windows Text Services\n  Framework Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-96022\n  Windows Text Services\n  Framework Information Disclosure Vulnerability\n  Important\n  5.6\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-119829\n  Windows USB Audio\n  Class driver (usbaudio.sys) Elevation of Privilege Vulnerability\n  Important\n  6.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-112764\n  Windows USB Driver\n  Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119872\n  Windows USB Driver\n  Elevation of Privilege Vulnerability\n  Important\n  6.4\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-122167\n  Windows USB Driver\n  Elevation of Privilege Vulnerability\n  Important\n  6.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-95872\n  Windows USB Driver\n  Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-96005\n  Windows USB Driver\n  Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-96051\n  Windows USB Driver\n  Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-96055\n  Windows USB Driver\n  Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-96056\n  Windows USB Driver\n  Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-96057\n  Windows USB Driver\n  Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-95902\n  Windows USB Hub Driver\n  Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-95999\n  Windows USB Hub Driver\n  Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  3\n  EoP\n \n \n  CVE-2026-96041\n  Windows USB Hub Driver\n  Information Disclosure Vulnerability\n  Important\n  5.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-119876\n  Windows USB Scanner\n  Driver Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-112984\n  Windows USB Video\n  Driver Elevation of Privilege Vulnerability\n  Important\n  6.6\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-112990\n  Windows USB Video\n  Driver Elevation of Privilege Vulnerability\n  Important\n  4.7\n  No\n  No\n  3\n  EoP\n \n \n  CVE-2026-95961\n  Windows USB Video\n  Driver Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-95965\n  Windows USB Video\n  Driver Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-97000\n  Windows USM\n  Communication Manager Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119837\n  Windows Universal Disk\n  Format File System Driver (UDFS) Elevation of Privilege Vulnerability\n  Important\n  7.5\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119840\n  Windows Universal Disk\n  Format File System Driver (UDFS) Elevation of Privilege Vulnerability\n  Important\n  6.3\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-122984\n  Windows Universal Disk\n  Format File System Driver (UDFS) Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-122162\n  Windows Update Stack\n  Information Disclosure Vulnerability\n  Important\n  5.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-95987\n  Windows User Manager\n  Service Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-96037\n  Windows User Manager\n  Service Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-95962\n  Windows Virtual\n  Filtering Platform (VFP) Remote Code Execution Vulnerability\n  Important\n  9\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-96086\n  Windows WLAN Service\n  Denial of Service Vulnerability\n  Important\n  6.5\n  No\n  No\n  2\n  DoS\n \n \n  CVE-2026-105028\n  Windows Win32k\n  Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119827\n  Windows Win32k\n  Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-119899\n  Windows Win32k\n  Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-122170\n  Windows Win32k\n  Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-108423\n  Windows WinHTTP\n  Information Disclosure Vulnerability\n  Important\n  4.7\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-105589\n  Windows Wireless\n  Networking Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-113760\n  Windows XWizard\n  Framework Elevation of Privilege Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-112801\n  Windows eSCL Scanner\n  Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-95956\n  Windows eSCL Scanner\n  Remote Code Execution Vulnerability\n  Important\n  8.1\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-112766\n  Windows exFAT File\n  System Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  3\n  EoP\n \n \n  CVE-2026-112804\n  Windows exFAT File\n  System Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-122177\n  Windows iSCSI\n  Elevation of Privilege Vulnerability\n  Important\n  7.5\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-95898\n  Windows iSCSI\n  Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-88231\n  Windows iSCSI\n  Information Disclosure Vulnerability\n  Important\n  5.7\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-105518\n  Windows iSCSI Remote\n  Code Execution Vulnerability\n  Important\n  8.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-88234\n  Windows iSCSI Remote\n  Code Execution Vulnerability\n  Important\n  9.8\n  No\n  No\n  2\n  RCE\n \n \n  CVE-2026-83684\n  Windows iSCSI Target\n  Service Information Disclosure Vulnerability\n  Important\n  7.5\n  No\n  No\n  2\n  Info\n \n \n  CVE-2026-105522\n  Winlogon Elevation of\n  Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-83563\n  Winlogon Elevation of\n  Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  1\n  EoP\n \n \n  CVE-2026-105526\n  Winsock Elevation of\n  Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-96994\n  Winsock Elevation of\n  Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  2\n  EoP\n \n \n  CVE-2026-95874\n  Xbox Gaming Services\n  Elevation of Privilege Vulnerability\n  Important\n  7.8\n  No\n  No\n  1\n  EoP\n \n \n  CVE-2026-95989\n  vhdmp.sys\n  Elevation of Privilege Vulnerability\n  Important\n  7\n  No\n  No\n  1\n  EoP\n \n \n \n  \n  \n  \n  \n  \n  \n  \n  \n \n \n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n\n\n\n\n\n\n  \n* Indicates this CVE had been released by a third party and is now being included in Microsoft releases.\n** Indicates this CVEs has already been resolved by Microsoft, and no further action is needed by the end user.\n \nAs with last month, I\u2019ll do my best to summarize everything else in this release but assume there are details I miss or that will be revised after the release. I\u2019ve tried to group these into cohorts of their own.\nLocal Privilege Escalations: As usual, EoP is the biggest category in the release. 425 of the EoP bugs require an attacker to already be on the box, and 245 of them hand over SYSTEM or administrator privileges. That\u2019s what makes them the second half of nearly every attack chain. None are listed as public or under active attack, but 33 are rated \u201cExploitation More Likely\u201d, which is where I\u2019d start. \nThe biggest cluster is the Windows Advanced Rasterization Platform, with 36 CVEs. Twenty-eight score CVSS 8.8 with a changed scope. For these cases, an attacker running a malicious app inside an AppContainer feeds crafted graphics data to an isolated compilation service and escapes the container. \nHyper-V earns eight Critical-rated EoPs. Two of them score 8.2 with a changed scope, and the first one lets an attacker reach VTL1. Windows Remote Desktop Services (CVE-2026-119957), TPM (CVE-2026-119382), and Graphics Kernel (CVE-2026-119966) make up the rest of the local Criticals. If you run Hyper-V hosts, don\u2019t skip these.\nThe rest is the usual long tail: Graphics Kernel (28), Installer (32), Kernel (18), Print Spooler (14), and DWM (9), plus smaller clusters in the Audio Service, Broadcast DVR User Service, USB drivers, and LSASS. Individually, none of these will make headlines. Collectively, they\u2019re a very large pile of ways to become SYSTEM. Rootkits, anyone?\nOffice-Related Bugs: Similar to last month, Office takes a big share of the release, with Word at 65 CVEs and Excel at 64. The bulk is remote code execution: 154 of the 201 are RCEs, along with 25 information disclosure bugs, 10 EoPs, and 11 spoofing bugs. Twenty-two are rated Critical. Excel has 12 of those, Word has 4, Outlook has 3, the general Office component has 2, and PowerPoint has 1. The ones to look at first are those where the Preview Pane is an attack vector, since the user never has to open the file. Ten bugs fit this description.\nSharePoint Server adds 30 CVEs, and it\u2019s a different mix from the rest of Office: 10 spoofing, 9 EoP, 7 RCE, and 3 info disclosure. The seven RCEs are mainly deserialization of untrusted data. The ones I checked need only an authenticated attacker with low-level access to send a crafted request, with no user interaction. CVE-2026-120002 is the highest score in the group at CVSS 9.9, an incorrect authorization EoP over the network. SharePoint has been a frequent target, so I wouldn\u2019t wait for in-the-wild reports to patch.\nExchange Server: Exchange Server gets 9 bugs this month: two RCEs, four EoPs, one denial of service, and two spoofing bugs. One is Critical, and none are publicly known or exploited. The Critical RCE (8.8) needs only a low-privileged login and no user interaction, and Microsoft rates it \u201cExploitation More Likely\u201d, the only Exchange bug with that rating. It\u2019s the one I\u2019d patch first, along with the Windows Search bug covered earlier. The other RCE (also 8.8) is rated \u201cExploitation Unlikely\u201d. The four EoPs score between 7.2 and 8.8, and the DoS lands at 7.5. The spoofing bugs may seem least worrying, but these often turn into credential relaying, so don\u2019t discount them. As always with Exchange, keep in mind that it\u2019s a favorite target, so patch these on a faster schedule than the scores suggest. And good luck Exchange Admins. I know you\u2019ve had a rough few months. \u2220(\u2018-\u2018 )\nSQL Server: SQL Server is the biggest single product in the release, with 59 bugs once you count the OLE DB and JDBC drivers. RCEs lead at 25, followed by 22 EoPs and 11 information disclosure bugs, with a few spoofing, bypass, DoS, and tampering bugs. All are Important, none are publicly known or exploited, and nearly all are rated \u201cExploitation Less Likely\u201d.\nHeap buffer overflows dominate the root causes at 24, followed by 11 SQL injection flaws. The top score is a 9.8 RCE that doesn\u2019t require authentication, where an attacker who controls a network endpoint used by an integration package returns a crafted response. Many of the 8.8 RCEs need only a low-privileged login, and several need no user interaction. Most of the others are in the 7 to 8.8 range. If you run SQL Server, plan on testing and deploying these, since the volume suggests a lot of attention on the product.\nWindows networking and remote access: Networking and remote access is a big group this month. EoP leads with 70 CVEs, followed by 48 RCEs, 30 information disclosure bugs, and 23 denial-of-service bugs. The one that surprised me is Kerberos. CVE-2026-85844 is an authentication bypass rated CVSS 9.8 that only gets an Important rating. According to the advisory, an unauthenticated attacker sends crafted Kerberos traffic and relays the resulting authentication to a domain controller, gaining SYSTEM on it with no user interaction. Don\u2019t let the Important label fool you. \nDNS has 33 CVEs between the Windows DNS and DNS Server components, 10 of them RCEs. Fifteen are information disclosure bugs, and 13 of the DNS bugs score only 4.9. The DNS Server role alone has 11. Between DHCP Server (9 bugs, 4 of them RCE) and DNS, the infrastructure services most networks run on get a lot of attention.\nSome of the Critical bugs need a bit more than a network connection. The Windows TCP/IP RCE and the Function Discovery SSDP Provider RCE are both use-after-free bugs reached over an adjacent network, rated 7.5. The SMB Server bug in srvnet.sys also scores 7.5, but it needs a login and a won race condition. Race conditions get beaten at Pwn2Own all the time, so I wouldn\u2019t count on that.\nThe client side is worth a look too. Remote Desktop Client has 12 CVEs, including four RCEs, where an attacker hosts a malicious server and convinces a user to connect. The NFS client follows the same pattern, with two RCEs and four additional bugs. The Remote Desktop Services and Gateway components add 7 more, including one authenticated RCE.\nAzure, cloud and identity: Azure and identity bugs are a small slice of the release this month, with a mere 52 in total. Four are rated Critical: Azure OpenAI, Azure Managed Grafana, and two Active Directory Domain Services bugs. \nThe scariest numbers belong to Azure OpenAI (9.8, missing authentication on a critical function) and two 9.9s in Microsoft Identity Manager and Azure DevOps. The Identity Manager bug is an EoP, and the DevOps one is an RCE. Cloud-service bugs often show up with big scores and nothing to deploy. Don\u2019t assume that here. Microsoft\u2019s data lists every one of these as \u201cCustomer Action Required: Yes\u201d, so I\u2019d verify each one before dismissing it. The Active Directory Domain Services pair is the one to watch for on-prem teams. One is an RCE at 8.8 and the other is a Critical EoP, and both are rated \u201cExploitation More Likely\u201d.\nWindows graphics, media and printing: EoP bugs dominate this group, with 163 of the 213 bugs. Another 26 are information disclosure bugs and 24 are RCEs. Only six are rated Critical: Graphic Fonts and the Raw Image Extension (both 8.8 RCEs), a Codecs Library RCE, a Print Spooler RCE, and two Graphics Kernel EoPs.\nThe biggest clusters are the Advanced Rasterization Platform (37), the Graphics Kernel (35), Print Spooler (20), and Desktop Window Manager (9), with the Win32K, audio, and Broadcast DVR components behind them. The scariest scores are in the media parsers, not graphics. DirectMusic, Media Foundation, and Color Management each have RCEs scoring 9.8. The 24 RCEs are spread across the Codecs Library, DirectMusic, Color Management, Media Foundation, and the XPS converter, among others. Most are on the wormable list, so look there before you triage them. The other piece worth noting is the Raw Image Extension, where a bug can fire just by viewing a folder with a malicious RAW file in it\n Windows storage file systems and drivers: EoP leads again here at about 80 bugs, followed by roughly 15 RCEs and 16 information disclosure bugs. Only one is rated Critical, an EoP in the TPM. Everything else lands at Important. The scariest scores are in the storage stack. iSCSI has a 9.8 RCE and is on the wormable list. The Storage Spaces Controller adds three more 8.8 RCEs. Windows Storage itself is the biggest component, and over half of its bugs are RCEs. The rest of the group is a long tail across NTFS, USB drivers, the Overlay Filter, Storport, the Cloud Files filter, and HID. About two dozen bugs need physical access, which is mostly the USB, HID, and BitLocker side of the group. Those are lower risk for most enterprises but matter for kiosks and shared machines.\n .NET and Visual Studio: Developer tooling is a mid-sized group this month with a paltry 44 bugs, and none of them break out of the Important rating. RCEs and security feature bypasses lead at 12 each, with denial of service (10), EoPs (6), and information disclosure (4) behind them. Visual Studio Code is the story again, with 19 bugs. Almost all of them need user interaction, typically opening something malicious. Microsoft rates two of the VS Code bugs, one RCE and one bypass, \u201cExploitation More Likely\u201d, the only ones in this group with that rating. Remember that the editor sits on developer machines full of credentials and source, so I\u2019d treat that as a priority.  The ASP.NET Core and .NET bugs are quieter. ASP.NET Core has 15 bugs, .NET has 12, split among DoS, EoP, bypass, and two RCEs. The rest are PowerShell, .NET Aspire, JScript, and a GitHub Copilot extension, in keeping with the year\u2019s steady trickle of AI-adjacent tools.\nWindows Security and identity: This is a small group, and EoP carries it with about 30 of the roughly 50 bugs. The rest is a mix of denial of service (8), information disclosure (4), security feature bypass (3), and one spoofing bug. Only one is rated Critical: an RCE in Microsoft Defender (8.8). The standout is Kerberos. It\u2019s covered in the networking section, but I\u2019d put it near the top of the list overall because it lets an unauthenticated attacker become SYSTEM on a domain controller. The Defender RCE also needs a closer look. It requires user interaction, but it hits the product people count on to catch the attackers. The rest is the usual: credential handling, sign-in, and firewall bugs, plus a pair of Secure Kernel Mode issues.\nMicrosoft Dynamics: Dynamics adds just one bug this month: an information disclosure in Dynamics 365 on-premises (6.5). It is not publicly known or exploited.\nWhat\u2019s left is the Windows plumbing: Installer, Kernel, Shell, and a long list of single-bug services such as Task Scheduler, WMI, Performance Counters, Event Viewer, and Sandbox. EoP leads with 51 of the roughly 120, followed by 36 information disclosure bugs, 12 RCEs, and a few tampering, bypass, and spoofing bugs. None are Critical, and none are publicly known or exploited.\nNo new advisories are being released this month.\nLooking Ahead\nThe final Patch Tuesday of the year will be on December 8. Regardless of how big (or how small!) the release may be, I\u2019ll be back to do my best to discern what you need to know. Until then, stay safe, happy patching, and may all your reboots be smooth and clean!", "url": "https://www.thezdi.com/blog/2026/11/10/the-november-2026-security-update-review"}, {"timestamp": "2026-11-10T18:19:46Z", "date_only": false, "value": "2026-11-10T18:19:46.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.securityweek.com/exploited-outlook-zero-day-among-1094-flaws-patched-by-microsoft/", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "2be008e0-df22-4faa-a925-4315f3965539", "content": "CVE-2026-124194 is the Outlook zero-day for which Microsoft says it\u2019s aware of active exploitation.\u00a0\n\nThe post Exploited Outlook Zero-Day Among 1,094 Flaws Patched by Microsoft appeared first on SecurityWeek.", "url": "https://www.securityweek.com/exploited-outlook-zero-day-among-1094-flaws-patched-by-microsoft/"}, {"timestamp": "2026-11-10T18:22:22.493Z", "date_only": false, "value": "2026-11-10T18:22:22.493Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-124194", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-10T18:26:59.155Z", "date_only": false, "value": "2026-11-10T18:26:59.155123Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thecircuitry.to/post/3mzy2wngb6c2p", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "fb32acf6-bf5b-4872-add9-0589efb9247d", "content": "Microsoft says Outlook flaw CVE-2026-124194 is already exploited.\nIt is a moderate spoofing bug, and the preview pane is not the way in.\n\nthecircuitry.to/article/microsoft-says-an-outlook-spoofing-flaw-is-already-exploited-mwb0s2mb", "url": "https://bsky.app/profile/thecircuitry.to/post/3mzy2wngb6c2p"}, {"timestamp": "2026-11-10T18:46:26Z", "date_only": false, "value": "2026-11-10T18:46:26.000000Z", "kind": "sighting", "label": "Seen", "source": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0474", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "6b028c41-5c07-48a4-bf26-35d598fb627a", "content": "Microsoft heeft kwetsbaarheden verholpen in diverse Office producten. Een kwaadwillende kan de kwetsbaarheden misbruiken om aanvallen uit te voeren die kunnen leiden tot de categorie\u00ebn schade, zoals genoemd in onderstaande tabellen.\n\nMicrosoft heeft voor Office meerdere kwetsbaarheden verholpen. De 2 ernstigste kwetsbaarheden bevinden zich in Sharepoint en hebben een CVSS score van 9.0 en 9.9 toegewezen gekregen. Voor succesvol misbruik van een aantal kwetsbaarheden moet de kwaadwillende het slachtoffer misleiden om een malafide bestand te openen of een malafide link te volgen.\n\nDe kwetsbaarheid met kenmerk CVE-2026-109454 betreft cross-site scripting (XSS) in SharePoint. Een geautoriseerde kwaadwillende kan deze kwetsbaarheid via het netwerk misbruiken om spoofing uit te voeren. Voor de kwetsbaarheid met kenmerk CVE-2026-120002 geldt dat een geautoriseerde kwaadwillende door onvoldoende autorisatiecontroles in Microsoft Office SharePoint via het netwerk verhoogde rechten kan verkrijgen.\n\nDe overige kwetsbaarheden vari\u00ebren in ernst van middelmatig tot hoog. Een samenvatting is in deze advisory opgenomen, maar het voert te ver om elke kwetsbaarheid in detail weer te geven. Raapleeg het MSRC-portaal voor aanvullende informatie.\n\n```\nMicrosoft Teams: \n|------------------|------|-------------------------------------|\n| CVE-ID           | CVSS | Impact                              |\n|------------------|------|-------------------------------------|\n| CVE-2026-116926  | 7.50 | Voordoen als andere gebruiker       | \n|------------------|------|-------------------------------------|\n\nMicrosoft Office PowerPoint: \n|------------------|------|-------------------------------------|\n| CVE-ID           | CVSS | Impact                              |\n|------------------|------|-------------------------------------|\n| CVE-2026-109487  | 7.50 | Uitvoeren van willekeurige code     | \n| CVE-2026-112734  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-112737  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-112738  | 6.50 | Toegang tot gevoelige gegevens      | \n| CVE-2026-116922  | 6.50 | Toegang tot gevoelige gegevens      | \n| CVE-2026-120001  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-120005  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-120787  | 7.50 | Uitvoeren van willekeurige code     | \n|------------------|------|-------------------------------------|\n\nMicrosoft Office Excel: \n|------------------|------|-------------------------------------|\n| CVE-ID           | CVSS | Impact                              |\n|------------------|------|-------------------------------------|\n| CVE-2026-111292  | 6.50 | Toegang tot gevoelige gegevens      | \n| CVE-2026-116927  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-118292  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-118293  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-118294  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-118295  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-118296  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-118297  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-118298  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-118299  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-118300  | 6.50 | Toegang tot gevoelige gegevens      | \n| CVE-2026-118301  | 7.50 | Uitvoeren van willekeurige code     | \n| CVE-2026-118302  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-118700  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-118701  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-118702  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-118703  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-118704  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-118705  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-118706  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-118707  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-118708  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-118709  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-118710  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-118711  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-118712  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-118713  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-118714  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-118715  | 8.80 | Verkrijgen van verhoogde rechten    | \n| CVE-2026-118716  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-118717  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-118718  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-118719  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-118720  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-118721  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-118722  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-118723  | 7.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-118724  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-118725  | 8.80 | Verkrijgen van verhoogde rechten    | \n| CVE-2026-118726  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-118727  | 6.50 | Toegang tot gevoelige gegevens      | \n| CVE-2026-118728  | 6.50 | Toegang tot gevoelige gegevens      | \n| CVE-2026-118729  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-118730  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-118731  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-118732  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-119986  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-119999  | 6.50 | Toegang tot gevoelige gegevens      | \n| CVE-2026-120785  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-120786  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-120788  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-120789  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-120790  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-120791  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-123385  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-123395  | 5.90 | Toegang tot gevoelige gegevens      | \n| CVE-2026-124170  | 7.50 | Uitvoeren van willekeurige code     | \n| CVE-2026-124172  | 7.50 | Uitvoeren van willekeurige code     | \n| CVE-2026-124174  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-124176  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-124178  | 6.50 | Toegang tot gevoelige gegevens      | \n| CVE-2026-124179  | 6.50 | Toegang tot gevoelige gegevens      | \n| CVE-2026-124183  | 6.50 | Toegang tot gevoelige gegevens      | \n| CVE-2026-124187  | 8.80 | Uitvoeren van willekeurige code     | \n|------------------|------|-------------------------------------|\n\nMicrosoft Office Outlook: \n|------------------|------|-------------------------------------|\n| CVE-ID           | CVSS | Impact                              |\n|------------------|------|-------------------------------------|\n| CVE-2026-110043  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-110068  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-111309  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-119993  | 6.50 | Toegang tot gevoelige gegevens      | \n| CVE-2026-119995  | 7.50 | Uitvoeren van willekeurige code     | \n| CVE-2026-119996  | 7.50 | Uitvoeren van willekeurige code     | \n| CVE-2026-119997  | 7.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-123375  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-123376  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-123377  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-123378  | 7.50 | Uitvoeren van willekeurige code     | \n| CVE-2026-123379  | 7.50 | Uitvoeren van willekeurige code     | \n| CVE-2026-123380  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-123381  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-123382  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-123383  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-123384  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-124194  | 6.50 | Voordoen als andere gebruiker       | \n|------------------|------|-------------------------------------|\n\nMicrosoft Office Word: \n|------------------|------|-------------------------------------|\n| CVE-ID           | CVSS | Impact                              |\n|------------------|------|-------------------------------------|\n| CVE-2026-109491  | 7.50 | Uitvoeren van willekeurige code     | \n| CVE-2026-109500  | 7.50 | Uitvoeren van willekeurige code     | \n| CVE-2026-109501  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-109503  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-109505  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-110046  | 6.50 | Toegang tot gevoelige gegevens      | \n| CVE-2026-110047  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-110048  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-110049  | 7.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-110050  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-110051  | 6.50 | Toegang tot gevoelige gegevens      | \n| CVE-2026-110052  | 7.50 | Uitvoeren van willekeurige code     | \n| CVE-2026-110053  | 7.50 | Uitvoeren van willekeurige code     | \n| CVE-2026-110054  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-110055  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-110056  | 7.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-110061  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-110062  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-110064  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-110066  | 6.50 | Toegang tot gevoelige gegevens      | \n| CVE-2026-110067  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-111285  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-111287  | 7.50 | Uitvoeren van willekeurige code     | \n| CVE-2026-111288  | 6.50 | Toegang tot gevoelige gegevens      | \n| CVE-2026-111290  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-111294  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-111295  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-111298  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-111299  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-111302  | 7.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-111304  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-111306  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-111307  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-111308  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-111310  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-112714  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-112715  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-112716  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-112717  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-112718  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-112719  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-112720  | 5.50 | Toegang tot gevoelige gegevens      | \n| CVE-2026-112721  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-112722  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-112723  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-112724  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-112726  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-112728  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-112729  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-112730  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-112733  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-112735  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-112739  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-112741  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-113759  | 7.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-116718  | 7.50 | Uitvoeren van willekeurige code     | \n| CVE-2026-116719  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-116720  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-116721  | 6.50 | Toegang tot gevoelige gegevens      | \n| CVE-2026-116722  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-116923  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-116925  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-123394  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-124185  | 7.50 | Uitvoeren van willekeurige code     | \n| CVE-2026-62804   | 7.80 | Uitvoeren van willekeurige code     | \n|------------------|------|-------------------------------------|\n\nMicrosoft Office Visio: \n|------------------|------|-------------------------------------|\n| CVE-ID           | CVSS | Impact                              |\n|------------------|------|-------------------------------------|\n| CVE-2026-109494  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-109496  | 8.80 | Uitvoeren van willekeurige code     | \n|------------------|------|-------------------------------------|\n\nMicrosoft Teams for Android: \n|------------------|------|-------------------------------------|\n| CVE-ID           | CVSS | Impact                              |\n|------------------|------|-------------------------------------|\n| CVE-2026-122979  | 8.10 | Voordoen als andere gebruiker       | \n| CVE-2026-69901   | 7.50 | Voordoen als andere gebruiker       | \n|------------------|------|-------------------------------------|\n\nMicrosoft Office OneNote: \n|------------------|------|-------------------------------------|\n| CVE-ID           | CVSS | Impact                              |\n|------------------|------|-------------------------------------|\n| CVE-2026-116924  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-119994  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-124181  | 7.50 | Uitvoeren van willekeurige code     | \n|------------------|------|-------------------------------------|\n\nMicrosoft Office: \n|------------------|------|-------------------------------------|\n| CVE-ID           | CVSS | Impact                              |\n|------------------|------|-------------------------------------|\n| CVE-2026-111286  | 7.50 | Uitvoeren van willekeurige code     | \n| CVE-2026-111289  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-111291  | 6.50 | Toegang tot gevoelige gegevens      | \n| CVE-2026-111293  | 6.50 | Toegang tot gevoelige gegevens      | \n| CVE-2026-112731  | 6.50 | Toegang tot gevoelige gegevens      | \n| CVE-2026-116717  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-119998  | 6.50 | Omzeilen van beveiligingsmaatregel  | \n| CVE-2026-120003  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-122198  | 8.80 | Uitvoeren van willekeurige code     | \n|------------------|------|-------------------------------------|\n\nMicrosoft Office SharePoint: \n|------------------|------|-------------------------------------|\n| CVE-ID           | CVSS | Impact                              |\n|------------------|------|-------------------------------------|\n| CVE-2026-109454  | 9.00 | Voordoen als andere gebruiker       | \n| CVE-2026-109455  | 6.50 | Toegang tot gevoelige gegevens      | \n| CVE-2026-109464  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-109466  | 8.00 | Verkrijgen van verhoogde rechten    | \n| CVE-2026-109472  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-109495  | 6.60 | Verkrijgen van verhoogde rechten    | \n| CVE-2026-109497  | 7.30 | Voordoen als andere gebruiker       | \n| CVE-2026-109499  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-109502  | 8.80 | Verkrijgen van verhoogde rechten    | \n| CVE-2026-109504  | 7.30 | Voordoen als andere gebruiker       | \n| CVE-2026-110044  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-110045  | 7.30 | Voordoen als andere gebruiker       | \n| CVE-2026-110057  | 6.50 | Toegang tot gevoelige gegevens      | \n| CVE-2026-110065  | 7.30 | Voordoen als andere gebruiker       | \n| CVE-2026-111296  | 8.00 | Verkrijgen van verhoogde rechten    | \n| CVE-2026-111297  | 8.00 | Voordoen als andere gebruiker       | \n| CVE-2026-111300  | 7.30 | Voordoen als andere gebruiker       | \n| CVE-2026-111303  | 7.30 | Voordoen als andere gebruiker       | \n| CVE-2026-112736  | 5.30 | Voordoen als andere gebruiker       | \n| CVE-2026-120000  | 7.50 | Uitvoeren van willekeurige code     | \n| CVE-2026-120002  | 9.90 | Verkrijgen van verhoogde rechten    | \n| CVE-2026-80095   | 9.00 | Verkrijgen van verhoogde rechten    | \n| CVE-2026-88176   | 8.80 | Verkrijgen van verhoogde rechten    | \n|------------------|------|-------------------------------------|\n\nMicrosoft Office Access: \n|------------------|------|-------------------------------------|\n| CVE-ID           | CVSS | Impact                              |\n|------------------|------|-------------------------------------|\n| CVE-2026-109493  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-109498  | 7.50 | Uitvoeren van willekeurige code     | \n| CVE-2026-110058  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-110059  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-110060  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-111301  | 8.80 | Uitvoeren van willekeurige code     | \n| CVE-2026-111305  | 8.80 | Uitvoeren van willekeurige code     | \n|------------------|------|-------------------------------------|\n\n```", "url": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0474"}, {"timestamp": "2026-11-10T18:50:16.952Z", "date_only": false, "value": "2026-11-10T18:50:16.952164Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/patchsonar.com/post/3mzy4adrxyb2k", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "3e637754-8abe-465f-939c-949276570833", "content": "Vendor-confirmed zero-day: Microsoft Outlook\nMicrosoft says attackers are exploiting a flaw in Outlook\n\nWhat to do: Install the latest Microsoft security updates. On a PC: Settings, Windows Update, Check for updates, then restart.\n\nhttps://patchsonar.com/cve/CVE-2026-124194 #ZeroDay #CyberSecurity", "url": "https://bsky.app/profile/patchsonar.com/post/3mzy4adrxyb2k"}, {"timestamp": "2026-11-10T19:19:29.274Z", "date_only": false, "value": "2026-11-10T19:19:29.274148Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/circuitandcapital.bsky.social/post/3mzy5uk533s26", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "421d0767-c92c-456b-8178-95c3b652f585", "content": "Microsoft's November Patch Tuesday fixes an Outlook bug already exploited in the wild (CVE-2026-124194). Opening a crafted file can leak the user's sign-in hash. Update Office / Microsoft 365 Apps on every PC this week.", "url": "https://bsky.app/profile/circuitandcapital.bsky.social/post/3mzy5uk533s26"}, {"timestamp": "2026-11-10T19:20:48Z", "date_only": false, "value": "2026-11-10T19:20:48Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-69HG-PPJJ-GG27", "record": "GHSA-69HG-PPJJ-GG27", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-11-10T19:20:48.180Z", "date_only": false, "value": "2026-11-10T19:20:48.180", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-124194", "record": "FKIE_CVE-2026-124194", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-10T19:21:00Z", "date_only": false, "value": "2026-11-10T19:21:00.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.jpcert.or.jp/english/at/2026/at260035.html", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "637dad5f-1e68-41db-af09-ec337e0b2dd7", "url": "https://www.jpcert.or.jp/english/at/2026/at260035.html"}, {"timestamp": "2026-11-10T19:47:31.561Z", "date_only": false, "value": "2026-11-10T19:47:31.561503Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/arc-codex.com/post/3mzy7gp5x4o2m", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "af864cd0-c295-4f8b-be54-9f953ec936d4", "content": "Microsoft Patch Tuesday November 2027 , (Tue, Nov 10th)\n\nThis article focuses heavily on the sheer volume of vulnerabilities, yet it minimizes the risk posed by the actively exploited Outlook spoofing vulnerability (CVE-2026-124194) being addressed immediately. Given\u2026\n\nvia SANS Internet Storm Center", "url": "https://bsky.app/profile/arc-codex.com/post/3mzy7gp5x4o2m"}, {"timestamp": "2026-11-10T19:56:04.919Z", "date_only": false, "value": "2026-11-10T19:56:04.919916Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/dotbatman.com/post/3mzy7vy7f6c26", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "3bee600d-194e-4445-99b8-75c527c2781b", "content": "Yes, there are a lot of vulnerabilities addressed this month too - 1.260.\n\u201cOne of the vulnerabilities, CVE-2026-124194, a spoofing vulnerability in Outlook, is already being exploited\u201d.\nThanks for always being there to report on Patch Tuesday, Internet Storm Center!", "url": "https://bsky.app/profile/dotbatman.com/post/3mzy7vy7f6c26"}, {"timestamp": "2026-11-10T20:00:00Z", "date_only": false, "value": "2026-11-10T20:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.hkcert.org/security-bulletin/microsoft-monthly-security-update-november-2026", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "af5732bf-d316-42b5-a682-bcd5cdcba0fe", "url": "https://www.hkcert.org/security-bulletin/microsoft-monthly-security-update-november-2026"}, {"timestamp": "2026-11-10T20:00:01Z", "date_only": false, "value": "2026-11-10T20:00:01+00:00", "kind": "kev", "label": "Recorded", "source": "cisa-kev", "record": "CVE-2026-124194", "field": "timestamps.recorded_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "18197b96-abfb-460f-bfda-3ddc05096729", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-11-10T20:00:02.109Z", "date_only": false, "value": "2026-11-10T20:00:02.109159Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/18197b96-abfb-460f-bfda-3ddc05096729", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "03a8cb07-c860-4f93-92ab-b20e9d50cf7b", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/18197b96-abfb-460f-bfda-3ddc05096729", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-11-10T20:05:37.438Z", "date_only": false, "value": "2026-11-10T20:05:37.438604Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/ap/users/117524993192219894/statuses/117593644522143912", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "7c5d11fa-4278-4197-a17e-d4eb50775853", "content": "Vendor-confirmed zero-day: Microsoft OutlookMicrosoft says attackers are exploiting a flaw in Outlook\nWhat to do: Install the latest Microsoft security updates. On a PC: Settings, Windows Update, Check for updates, then restart.\nhttps://patchsonar.com/cve/CVE-2026-124194 #ZeroDay #CyberSecurity", "url": "https://infosec.exchange/ap/users/117524993192219894/statuses/117593644522143912"}, {"timestamp": "2026-11-10T20:06:18.148Z", "date_only": false, "value": "2026-11-10T20:06:18.148138Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/entorisec.bsky.social/post/3mzyaiayyfg2w", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "3cd16445-c8c2-498c-888e-392aaebe32c7", "content": "Microsoft's November Patch Tuesday fixes an Outlook flaw it says is under active exploitation, CVE-2026-124194. Opening a crafted message file can leak the user's NTLMv2 hash without the usual warning. Rated moderate, CVSS 6.5, per SecurityWeek.", "url": "https://bsky.app/profile/entorisec.bsky.social/post/3mzyaiayyfg2w"}, {"timestamp": "2026-11-10T20:08:53.343Z", "date_only": false, "value": "2026-11-10T20:08:53.343533Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/ifynxstudio.bsky.social/post/2tpstdv6u5b5f", "record": "cve-2026-124194", "field": "creation_timestamp", "uuid": "2501181a-8980-40bd-a4d0-8d5e663d26ab", "content": "Exploited Outlook zero-day CVE-2026-124194 (CVSS 6.5) leaks NTLMv2 hashes via a crafted message file. iFynx patch order for Gulf and Egypt:\n#iFynx #PatchTuesday\nhttps://ifynx.com/blog/outlook-zero-day-cve-2026-124194-november-2026-patch-tuesday-gulf-egypt/", "url": "https://bsky.app/profile/ifynxstudio.bsky.social/post/2tpstdv6u5b5f"}, {"timestamp": "2026-11-10T20:21:48.523Z", "date_only": false, "value": "2026-11-10T20:21:48.523161Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/infonewscyber.bsky.social/post/3mzybdxm5ux25", "record": "cve-2026-124194", "field": "creation_timestamp", "uuid": "2360e593-ba10-41e3-9d3f-643925c3f496", "content": "\u26a0\ufe0f FAILLE CRITIQUE\n\nCVE-2026-124194 activement exploit\u00e9e : Microsoft Office Outlook \u2013 Action potentiellement dangereuse sans interaction de l'u\u2026\n\n\ud83d\udd17 https://infonewscyber.fr/info/cve-2026-124194-activement-exploitee-microsoft-office-outlook-action-p-fe16241dfb0c4301\n#Microsoft #ZeroDay #Cybers\u00e9curit\u00e9", "url": "https://bsky.app/profile/infonewscyber.bsky.social/post/3mzybdxm5ux25"}, {"timestamp": "2026-11-10T20:32:37.069Z", "date_only": false, "value": "2026-11-10T20:32:37.069915Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/eventmonitor.bsky.social/post/3n236pdndkg4u", "record": "cve-2026-124194", "field": "creation_timestamp", "uuid": "c598aa5e-7617-492a-b855-3ca105c750e5", "content": "CVE-2026-124194: Microsoft Office Outlook Missing User Interaction For Potentially Unsafe Action Vulnerability\nhttps://cyber.eventmonitor.net/incident/EM-20261110-Y15M/cve-2026-124194-microsoft-office-outlook-missing-user-interaction/\n#news #cybersecurity", "url": "https://bsky.app/profile/eventmonitor.bsky.social/post/3n236pdndkg4u"}, {"timestamp": "2026-11-10T20:44:38.528Z", "date_only": false, "value": "2026-11-10T20:44:38.528790Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/byazb72fymfxh", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "51bfcd13-7ed6-4eb9-b95f-67867534e1e9", "content": "\ud83d\uded1 CVE-2026-124194\nCVSS 6.5 / KEV \u2705\nTL;DR: Product ui does not warn user of unsafe actions in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.\nhttps://cvesentinel.com/report/CVE-2026-124194\n#infosec #CVE #vulnerability", "url": "https://bsky.app/profile/cvesentinel.bsky.social/post/byazb72fymfxh"}, {"timestamp": "2026-11-10T20:47:50.166Z", "date_only": false, "value": "2026-11-10T20:47:50.166192Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/DarkWebInformer/statuses/117594106690963527", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "a7054916-fe85-4963-b9e8-2a9e8ee19761", "content": "\ud83d\udea8 Microsoft confirms hackers are exploiting Outlook zero-day to steal Windows authentication hashes, CVE-2026-124194\nMicrosoft has patched an actively exploited vulnerability in Outlook that could allow attackers to steal NTLM authentication hashes by tricking users into opening specially crafted files.\nThe flaw, tracked as CVE-2026-124194 (CVSS 6.5), allows Outlook to connect to attacker-controlled locations without displaying the usual external content security warning, potentially exposing credentials to further attacks.\nMicrosoft confirmed exploitation in the wild as part of its November 2026 Patch Tuesday updates. Users and administrators are urged to install the latest security fixes immediately.\nSource: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-124194\nNo delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing\nNeed API access? darkwebinformer.com/api-details\nCheck out the Telegram channel: t.me/SliceForLifeee", "url": "https://infosec.exchange/users/DarkWebInformer/statuses/117594106690963527"}, {"timestamp": "2026-11-10T20:55:03Z", "date_only": false, "value": "2026-11-10T20:55:03.000000Z", "kind": "sighting", "label": "Seen", "source": "https://krebsonsecurity.com/2026/11/microsoft-fixes-nearly-1100-security-vulnerabilities/", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "7589f7dd-c23f-4b7b-812a-7154278e4483", "content": "Microsoft did another four-digit patch drop today, releasing updates to fix almost 1,100 security vulnerabilities in its Windows operating systems and supported software. This month’s Patch Tuesday addresses 63 critical flaws — including a zero-day in Microsoft Outlook — and comes amid important security updates from other software makers, including Adobe, Apple, Google\u00a0and Mozilla.\n\n\nImage: Shutterstock.com. Diorama by @zepp1969.\n\nNovember’s patch release from Redmond tackles 1,093 vulnerabilities, fixing 63 “critical” flaws that can be exploited to seize control over a Windows system with little or no help from users. Nearly half of those critical bugs are remote code execution vulnerabilities. Overall, 535 of the flaws addressed this month allow an attacker to elevate their privileges on a vulnerable device.\n\nThis latest round of updates means Microsoft has shipped more than 5,100 security patches so far this year, a staggering number considering that a year ago Microsoft was averaging around 100 patches per month. Microsoft credits advances in artificial intelligence for helping to find (and fix) such a large volume of security bugs in recent months. Last month, Microsoft pushed more than 1,400 fixes.\n\nAccording to Redmond, just one of the flaws is already seeing active exploitation: CVE-2026-124194, a spoofing bug in Outlook. The advisory for CVE-2026-124194 says it affects Microsoft 365 Apps for Enterprise and editions of Microsoft Office.\n\nSeveral other major software makers pushed security updates this week to fix critical weaknesses in their products. Apple on Monday released out-of-cycle security updates to fix at least nine vulnerabilities in iOS/iPadOS, macOS, watchOS and visionOS. Among the weaknesses reportedly fixed in Apple’s release include an iMessage flaw that could let a remote attacker join a group chat and receive its messages; the updates also fix a separate iMessage flaw that could let someone added to a group access messages sent before they joined.\n\nLee Neely, an instructor at the SANS Institute, noted that Apple backported the fix to iOS 18.\n\n“I take notice when Apple releases fixes to more than two versions,” Neely wrote in a SANS newsletter today. “You really need to get to version 27.2.1 of their OSes and push folks who are holding onto devices which cannot run the current version. The best plan often involves setting an upgrade date for old hardware. Run through all your Apple devices and make sure everything is up to date, don’t assume the fixes went out automatically.”\n\nGoogle this week released Chrome version 157.0.8103.50, which resolves nine security holes, including\u00a0CVE-2026-125350, the sixth zero-day vulnerability this year for Chrome (this bug also being patched in Chromium-based browsers like Edge). The latest Chrome version follows its November 3 release, which fixed 213 vulnerabilities. A new version of Mozilla Firefox out today (Firefox 160) resolves almost 100 CVEs, about half of them high severity.\n\nAdobe today released patches for at least 110 vulnerabilities across a range of products, with nearly half of the flaws rated high severity. Adobe said there is no evidence any of the security holes it addressed this month are being actively exploited.\n\nChris Goettl, vice president of product management at Ivanti, said it’s easy for security teams at large enterprises to feel overwhelmed by the volume and criticality of patches from Microsoft lately. But he notes that while some 95,000 vulnerabilities have been assigned CVEs this year across all vendors, only 217 have so far this year been added to the Known Exploited Vulnerabilities (KEV) list maintained by the U.S. Cybersecurity and Infrastructure Security Agency (CISA).\n\n“Roughly four in ten of this year\u2019s exploited vulnerabilities sit in operating systems, endpoint software, browsers, and server platforms, which a continuous patch strategy can close quickly,” Goettl said.”The rest calls for exposure management alongside patching, especially the 44% that sit in edge devices and IT management or remote access tools, the internet-facing systems that hold privileged access. Teams that can quickly identify those assets, confirm exposure and act on confirmed exploitation can focus on the small slice of vulnerabilities attackers are actively using, while the rest stays on the normal patch cadence.”\n\nPlease don’t neglect to back up any important data if you haven’t recently; generally speaking, this is a task best accomplished before applying operating system updates. As ever, if you experience any issues applying this month’s bundle of love from Microsoft, please drop a comment about it in the space below.", "url": "https://krebsonsecurity.com/2026/11/microsoft-fixes-nearly-1100-security-vulnerabilities/"}, {"timestamp": "2026-11-10T20:55:25.106Z", "date_only": false, "value": "2026-11-10T20:55:25.106147Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/vulnidx-jp.bsky.social/post/3mzyda3w4x222", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "8d741ec8-ed1e-4ad8-bc7a-e64e3bc5f36b", "content": "\u3010\u60aa\u7528\u78ba\u8a8d\u3011CVE-2026-124194\nMicrosoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability\nMicrosoft Office\nCISA \u8ffd\u52a0 11/10\u30fb\u5bfe\u5fdc\u671f\u9650 11/24\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-124194\n#\u8106\u5f31\u6027 #KEV #Microsoft", "url": "https://bsky.app/profile/vulnidx-jp.bsky.social/post/3mzyda3w4x222"}, {"timestamp": "2026-11-10T21:13:23.309Z", "date_only": false, "value": "2026-11-10T21:13:23.309935Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pureinfotech.bsky.social/post/3mzyea5ueks2j", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "05a0c8c9-ba5a-4aec-847b-bdf942af7425", "content": "\ud83d\udd25 Microsoft's November security release fixes 1,094 vulnerabilities. The number that deserves a closer look is in Outlook: CVE-2026-124194 has been exploited.\n\nWindows accounts for 726 fixes.\n\n\u27a1\ufe0f pureinfotech.com/microsoft-no...", "url": "https://bsky.app/profile/pureinfotech.bsky.social/post/3mzyea5ueks2j"}, {"timestamp": "2026-11-10T21:15:04.148Z", "date_only": false, "value": "2026-11-10T21:15:04.148970Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/ninjaintelgroup.bsky.social/post/3mzyeda3mkh2v", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "4ea5b83e-4251-4e3e-85fe-358fa4ae84f5", "content": "\ud83d\udea8 NEW on CISA KEV \u2014 exploited in the wild\nMicrosoft Office: Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerabil\nCVE-2026-124194 \u00b7 patch by 2026-11-24\n\ud83d\udd17 https://ninjasignal.ninja/intel/cve/CVE-2026-124194\n#KEV #cybersecurity #infosec", "url": "https://bsky.app/profile/ninjaintelgroup.bsky.social/post/3mzyeda3mkh2v"}, {"timestamp": "2026-11-10T21:17:47.626Z", "date_only": false, "value": "2026-11-10T21:17:47.626960Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/chuiho.net/post/3mzyei3zkby2a", "record": "cve-2026-124194", "field": "creation_timestamp", "uuid": "e19fc187-b1d5-4e96-9426-2004c1652ff6", "content": "\ud83d\udea8\u901f\u5831\uff3b\u8b66\u6212\uff3dOutlook \u30bc\u30ed\u30c7\u30a4 CVE-2026-124194\u3001\u60aa\u7528\u78ba\u8a8d\u30fb11\u6708\u30d1\u30c3\u30c1\u3067\u4fee\u6b63\nMicrosoft Outlook\uff08Microsoft 365 Apps\u30fbOffice LTSC 2021/2024\uff09\u306e\u6b20\u9665 CVE-2026-124194 \u306f\u60aa\u7528\u304c\u78ba\u8a8d\u3055\u308c CISA KEV \u5165\u308a\u3002NTLMv2 \u30cf\u30c3\u30b7\u30e5\u6f0f\u3048\u3044\u306e\u5185\u5bb9\u3068\u66f4\u65b0\u306e\u78ba\u304b\u3081\u65b9\u3002\nhttps://chuiho.net/posts/outlook-zero-day-cve-2026-124194-november-patch/ #Outlook #CVE2026124194", "url": "https://bsky.app/profile/chuiho.net/post/3mzyei3zkby2a"}, {"timestamp": "2026-11-10T21:28:50.513Z", "date_only": false, "value": "2026-11-10T21:28:50.513189Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/axnews.bsky.social/post/3mzyf3uazkz2y", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "42071851-ce7c-45c8-a570-269247f42a5e", "content": "\u26a0\ufe0f Exploited in the wild: CVE-2026-124194\nMicrosoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability\nAdded to CISA KEV \u00b7 Medium 6.5\nImpacted if: Microsoft Office LTSC 2021 < 16.0.14334.21048\nhttps://ax-news.com/cve/CVE-2026-124194\n#CVE #KEV #infosec", "url": "https://bsky.app/profile/axnews.bsky.social/post/3mzyf3uazkz2y"}, {"timestamp": "2026-11-10T21:33:51Z", "date_only": false, "value": "2026-11-10T21:33:51Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-69HG-PPJJ-GG27", "record": "GHSA-69HG-PPJJ-GG27", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-10T21:33:51Z", "date_only": false, "value": "2026-11-10T21:33:51Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-69HG-PPJJ-GG27", "record": "GHSA-69HG-PPJJ-GG27", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-10T21:46:06.702Z", "date_only": false, "value": "2026-11-10T21:46:06.702542Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mzyg2qzsgk2k", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "12ac802e-c8c4-4d0b-89fd-c143c5286b7b", "content": "\ud83e\udd16 MS Nov 2026 Patch Tuesday: record 1,235 fixes, incl. an exploited Outlook 0-day (CVE-2026-124194) leaking NTLMv2 hashes. Patch now.\nhttps://www.bleepingcomputer.com/news/microsoft/microsoft-november-2026-patch-tuesday-fixes-1-235-flaws-outlook-zero-day/", "url": "https://bsky.app/profile/newssecia.bsky.social/post/3mzyg2qzsgk2k"}, {"timestamp": "2026-11-10T22:06:00.762Z", "date_only": false, "value": "2026-11-10T22:06:00.762268Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securityrss.bsky.social/post/3mzyh6cip2227", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "52b76725-73f4-4eae-83a0-e49bcce5cc10", "content": "Microsoft's November 2026 Patch Tuesday addresses 1,093 vulnerabilities, including a zero-day in Outlook (CVE-2026-124194) that exposes NTLMv2 hashes. The update includes 63 critical vulnerabilities, with 48 being remote code execution issues.", "url": "https://bsky.app/profile/securityrss.bsky.social/post/3mzyh6cip2227"}, {"timestamp": "2026-11-10T22:14:00.550Z", "date_only": false, "value": "2026-11-10T22:14:00.550141Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mzyhmmilfi25", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "9a0fefb5-0cda-4e44-8ce4-15744d5a4621", "content": "Microsoft November 2026 Patch Tuesday fixes 1,093 vulnerabilities, including an exploited Outlook zero-day, CVE-2026-124194, and a CVSS 10.0 Entra flaw.\n\n#Microsoft #PatchTuesday #ZeroDay #Outlook #Windows #CVE2026124194 #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/securityonline.bsky.social/post/3mzyhmmilfi25"}, {"timestamp": "2026-11-10T22:48:00.035Z", "date_only": false, "value": "2026-11-10T22:48:00.035456Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mzyjjgcebq2f", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "6329c42f-d18e-49d8-b19d-af4b23adf7cb", "content": "Microsoft patches Outlook zero-day CVE-2026-124194, a spoofing flaw exploited in the wild and added to CISA KEV. Install the November 2026 updates.\n\n#Microsoft #Outlook #ZeroDay #CVE2026124194 #PatchTuesday #ExploitedInTheWild #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/securityonline.bsky.social/post/3mzyjjgcebq2f"}, {"timestamp": "2026-11-10T22:55:46Z", "date_only": false, "value": "2026-11-10T22:55:46.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/ViralCyber/27383", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "d404c1b9-4b00-4d44-828d-2fed07d3279c", "content": "\ud83d\udcf5\u0647\u0634\u062f\u0627\u0631 \u0627\u0645\u0646\u06cc\u062a\u06cc \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a\u061b \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0628\u062d\u0631\u0627\u0646\u06cc \u062f\u0631 Exchange Server \u0648 \u062d\u0645\u0644\u0647 \u0641\u0639\u0627\u0644 \u0628\u0647 Outlook!\n\u25c0\ufe0f\u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0633\u0627\u0639\u0627\u062a\u06cc \u067e\u06cc\u0634 \u062f\u0631 \u0628\u0647\u200c\u0631\u0648\u0632\u0631\u0633\u0627\u0646\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc \u06f1\u06f0 \u0646\u0648\u0627\u0645\u0628\u0631 \u06f2\u06f0\u06f2\u06f6 (Patch Tuesday\u060c \u0627\u0632 \u0627\u0635\u0644\u0627\u062d \u06f1,\u06f0\u06f9\u06f3 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u062c\u062f\u06cc\u062f \u062f\u0631 \u0645\u062d\u0635\u0648\u0644\u0627\u062a \u062e\u0648\u062f \u062e\u0628\u0631 \u062f\u0627\u062f\u0647 \u0627\u0633\u062a.\n\u25c0\ufe0f\u062f\u0631 \u0627\u06cc\u0646 \u0628\u0647\u200c\u0631\u0648\u0632\u0631\u0633\u0627\u0646\u06cc\u060c \u06f9 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 Microsoft Exchange Server \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u0648 \u0627\u0635\u0644\u0627\u062d \u0634\u062f\u0647\u200c\u0627\u0646\u062f:\n\ud83d\udd34 \u06f2 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0627\u062c\u0631\u0627\u06cc \u06a9\u062f \u0627\u0632 \u0631\u0627\u0647 \u062f\u0648\u0631 (RCE)\n\ud83d\udd34 \u06f4 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0627\u0641\u0632\u0627\u06cc\u0634 \u0633\u0637\u062d \u062f\u0633\u062a\u0631\u0633\u06cc (Privilege Escalation)\n\ud83d\udd34 \u06f2 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u062c\u0639\u0644 \u0647\u0648\u06cc\u062a (Spoofing)\n\ud83d\udd34 \u06f1 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0627\u062e\u062a\u0644\u0627\u0644 \u0633\u0631\u0648\u06cc\u0633 (DoS)\n\n\u25c0\ufe0f \u0645\u0647\u0645\u200c\u062a\u0631\u06cc\u0646 \u0645\u0648\u0631\u062f: CVE-2026-118207\n\u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0627\u0632 \u0646\u0648\u0639 Remote Code Execution \u0628\u0627 \u0634\u062f\u062a Critical \u0648 \u0627\u0645\u062a\u06cc\u0627\u0632 CVSS \u0628\u0631\u0627\u0628\u0631 8.8 \u0627\u0633\u062a \u0648 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0628\u0647 \u0645\u0647\u0627\u062c\u0645 \u062f\u0627\u0631\u0627\u06cc \u0633\u0637\u062d \u062f\u0633\u062a\u0631\u0633\u06cc \u0645\u0648\u0631\u062f\u0646\u06cc\u0627\u0632 \u0627\u0645\u06a9\u0627\u0646 \u0627\u062c\u0631\u0627\u06cc \u06a9\u062f \u0631\u0648\u06cc \u0633\u0631\u0648\u0631 Exchange \u0631\u0627 \u0628\u062f\u0647\u062f.\n\u25c0\ufe0f \u06cc\u06a9 Zero-Day \u062f\u0631 Outlook \u0646\u06cc\u0632 \u062f\u0631 \u062d\u0645\u0644\u0627\u062a \u0648\u0627\u0642\u0639\u06cc \u0645\u0648\u0631\u062f \u0633\u0648\u0621\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0642\u0631\u0627\u0631 \u06af\u0631\u0641\u062a\u0647 \u0627\u0633\u062a!\n\u25c0\ufe0f\u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc CVE-2026-124194 \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u0628\u0627 \u0628\u0627\u0632 \u0634\u062f\u0646 \u0641\u0627\u06cc\u0644 \u0622\u0644\u0648\u062f\u0647 \u062a\u0648\u0633\u0637 \u06a9\u0627\u0631\u0628\u0631\u060c \u0628\u0627\u0639\u062b \u0627\u0641\u0634\u0627\u06cc NTLMv2 Hash \u0634\u0648\u062f\u061b \u0627\u0637\u0644\u0627\u0639\u0627\u062a\u06cc \u06a9\u0647 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0628\u0631\u0627\u06cc \u062d\u0645\u0644\u0627\u062a \u0628\u0639\u062f\u06cc \u0628\u0647 \u062d\u0633\u0627\u0628\u200c\u0647\u0627\u06cc \u0633\u0627\u0632\u0645\u0627\u0646\u06cc \u0645\u0648\u0631\u062f \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0642\u0631\u0627\u0631 \u06af\u06cc\u0631\u062f.\n\u26d4\ufe0f \u0647\u0634\u062f\u0627\u0631 \u0628\u0633\u06cc\u0627\u0631 \u0645\u0647\u0645 \u0628\u0631\u0627\u06cc Exchange 2016 \u0648 2019:\n\u25c0\ufe0f\u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0631\u0633\u0645\u0627\u064b \u0627\u0639\u0644\u0627\u0645 \u06a9\u0631\u062f\u0647 \u0627\u06cc\u0646 \u0646\u0633\u062e\u0647\u200c\u0647\u0627 \u062f\u06cc\u06af\u0631 \u062a\u062d\u062a \u0622\u0632\u0645\u0648\u0646\u200c\u0647\u0627\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc \u0648 \u0627\u0646\u062a\u0634\u0627\u0631 \u0648\u0635\u0644\u0647 \u0642\u0631\u0627\u0631 \u0646\u062f\u0627\u0631\u0646\u062f. \u0628\u0646\u0627\u0628\u0631\u0627\u06cc\u0646 \u0646\u0628\u0648\u062f \u0646\u0627\u0645 \u0622\u0646\u200c\u0647\u0627 \u062f\u0631 \u0641\u0647\u0631\u0633\u062a \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc\u200c\u0647\u0627\u06cc \u062c\u062f\u06cc\u062f\u060c \u0628\u0647 \u0645\u0639\u0646\u06cc \u0627\u0645\u0646 \u0628\u0648\u062f\u0646\u0634\u0627\u0646 \u0646\u06cc\u0633\u062a!\n\n\u2705 \u0627\u0642\u062f\u0627\u0645\u0627\u062a \u0636\u0631\u0648\u0631\u06cc:\n- \u0646\u0635\u0628 \u0641\u0648\u0631\u06cc \u0648\u0635\u0644\u0647\u200c\u0647\u0627\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc Exchange SE \u067e\u0633 \u0627\u0632 \u0627\u0631\u0632\u06cc\u0627\u0628\u06cc \u0648 \u0622\u0632\u0645\u0648\u0646\n- \u0628\u0631\u0646\u0627\u0645\u0647\u200c\u0631\u06cc\u0632\u06cc \u0645\u0647\u0627\u062c\u0631\u062a \u0627\u0632 Exchange 2016 \u0648 2019\n- \u0628\u0647\u200c\u0631\u0648\u0632\u0631\u0633\u0627\u0646\u06cc Outlook \u0648 Office\n- \u0628\u0631\u0631\u0633\u06cc \u062f\u0633\u062a\u0631\u0633\u06cc\u200c\u0647\u0627\u06cc \u0645\u062f\u06cc\u0631\u06cc\u062a\u06cc \u0648 \u067e\u0627\u06cc\u0634 \u0631\u0648\u06cc\u062f\u0627\u062f\u0647\u0627\u06cc \u0645\u0634\u06a9\u0648\u06a9\n#Microsoft #ExchangeServer #Outlook #PatchTuesday #CyberSecurity #ZeroDay\n\n\ud83d\udcf1 @PingChannel \n\u062e\u0628\u0631\u060c \u062a\u062d\u0644\u06cc\u0644\u060c \u0627\u0646\u062a\u0642\u0627\u062f - \u0641\u0646\u0627\u0648\u0631\u06cc \u0627\u0637\u0644\u0627\u0639\u0627\u062a\n\ud83c\udd70\ufe0f\ud83c\udd70\ufe0f\ud83c\udd70\ufe0f\ud83c\udd70\ufe0f", "url": "https://t.me/ViralCyber/27383"}, {"timestamp": "2026-11-10T22:58:39.981Z", "date_only": false, "value": "2026-11-10T22:58:39.981062Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securitylab-jp.bsky.social/post/3mzyk4g73j222", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "39381b77-e839-4dcc-8d7f-f73c9a11cac6", "content": "Microsoft\u300111\u6708\u5b9a\u4f8b\u30d1\u30c3\u30c1\u30671,093\u4ef6\u306e\u4fee\u6b63\u3000Outlook \u30bc\u30ed\u30c7\u30a4\u300cCVE-2026-124194\u300d\u30b5\u30a4\u30d0\u30fc\u653b\u6483\u306b\u5b9f\u60aa\u7528\u3001Windows\u30fbOffice\u306b\u3082\u91cd\u5927\u306a\u8106\u5f31\u6027 \n rocket-boys.co.jp/security-mea... \n\n#\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5bfe\u7b56Lab #security #securitynews #\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3 #\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30cb\u30e5\u30fc\u30b9", "url": "https://bsky.app/profile/securitylab-jp.bsky.social/post/3mzyk4g73j222"}, {"timestamp": "2026-11-10T23:00:00Z", "date_only": false, "value": "2026-11-10T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4479", "record": "WID-SEC-W-2026-4479", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-11-10T23:00:00Z", "date_only": false, "value": "2026-11-10T23:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4479", "record": "WID-SEC-W-2026-4479", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-10T23:00:00Z", "date_only": false, "value": "2026-11-10T23:00:00.000+00:00", "kind": "other", "label": "Release date", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4479", "record": "WID-SEC-W-2026-4479", "field": "vulnerabilities.195.release_date", "linked_record": true, "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-10T23:00:00Z", "date_only": false, "value": "2026-11-10T23:00:00.000+00:00", "kind": "other", "label": "Updated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4479", "record": "WID-SEC-W-2026-4479", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-11-10T23:05:06.904Z", "date_only": false, "value": "2026-11-10T23:05:06.904887Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mzykhzcfie2x", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "5210fde3-009d-40cd-a90e-a5171af21b3f", "content": "Microsoft Outlook\u306e\u30bc\u30ed\u30c7\u30a4\u8106\u5f31\u6027\uff08CVE-2026-124194\uff09\u304c\u4fee\u6b63\u3055\u308c\u305f\u3002\u653b\u6483\u8005\u306f\u3053\u308c\u3092\u60aa\u7528\u3057\u3001Outlook\u306e\u5229\u7528\u8005\u3092\u6a19\u7684\u306b\u3059\u308b\u3053\u3068\u304c\u53ef\u80fd\u3060\u3063\u305f\u3002", "url": "https://bsky.app/profile/postac001.bsky.social/post/3mzykhzcfie2x"}, {"timestamp": "2026-11-10T23:16:24.861Z", "date_only": false, "value": "2026-11-10T23:16:24.861898Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/unnchain.bsky.social/post/3mzyl47wql72r", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "a05e9a0e-d168-4397-8546-f0939f310ef4", "content": "Outlook\uff08Office\u30fbMicrosoft 365\uff09\u3092\u4f7f\u3063\u3066\u3044\u308b\u4eba\u3078\u3002\n\n\u60aa\u7528\u78ba\u8a8d\u6e08\u307f\u306e\u8106\u5f31\u6027CVE-2026-124194\uff08CVSS 6.5\uff09\u304c11\u6708\u306e\u6708\u4f8b\u66f4\u65b0\u3067\u4fee\u6b63\u3002\u7d30\u5de5\u3057\u305f\u30e1\u30fc\u30eb\u30d5\u30a1\u30a4\u30eb\u3092\u958b\u304f\u3068\u8b66\u544a\u306a\u3057\u306b\u653b\u6483\u8005\u306e\u30b5\u30fc\u30d0\u30fc\u3078\u63a5\u7d9a\u3057\u3001\u306a\u308a\u3059\u307e\u3057\u306b\u4f7f\u3048\u308b\u8a8d\u8a3c\u60c5\u5831\uff08NTLMv2\u30cf\u30c3\u30b7\u30e5\uff09\u304c\u6f0f\u308c\u308b\u6050\u308c\u3002\u30d7\u30ec\u30d3\u30e5\u30fc\u8868\u793a\u3060\u3051\u3067\u306f\u5bfe\u8c61\u5916\u3002CISA\u306eKEV\u306b\u3082\u8ffd\u52a0\u3002\n\n\u5bfe\u7b56\uff1aOffice\u3092\u6700\u65b0\u306b\uff08LTSC 2024\u306f16.0.17932.21140\u4ee5\u964d\u306a\u3069\uff09\n\nhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-124194", "url": "https://bsky.app/profile/unnchain.bsky.social/post/3mzyl47wql72r"}, {"timestamp": "2026-11-10T23:38:32.512Z", "date_only": false, "value": "2026-11-10T23:38:32.512868Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/marcfredericgomez.bsky.social/post/3mzymdotenk2i", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "9b55571e-18ec-4e04-946f-c408f0e78cd0", "content": "November 2026 Patch Tuesday: 1,093 vulnerabilities, 63 Critical, one exploited zero-day.\n\nCVE-2026-124194 in Outlook leaks the NTLMv2 hash. Rated Moderate, CVSS 6.5, yet in CISA KEV, due 24 Nov: don't triage by score alone.\n\nblog.marcfredericgomez.com/patch-tuesda...", "url": "https://bsky.app/profile/marcfredericgomez.bsky.social/post/3mzymdotenk2i"}, {"timestamp": "2026-11-10T23:39:46.876Z", "date_only": false, "value": "2026-11-10T23:39:46.876049Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/niztal.bsky.social/post/3mzymfz57hv2u", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "63ab956b-6aa9-4a9c-b911-536e980080d6", "content": "The update addresses 66 Critical bugs, 48 RCEs, and an active Outlook spoofing zero-day (CVE-2026-124194). Opening a malicious attachment forces Windows to connect to a remote server, leaking NTLMv2 hashes that attackers can crack offline.", "url": "https://bsky.app/profile/niztal.bsky.social/post/3mzymfz57hv2u"}, {"timestamp": "2026-11-10T23:45:28.670Z", "date_only": false, "value": "2026-11-10T23:45:28.670175Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thelabledger.bsky.social/post/3mzymq5e7hs2r", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "83f84bf2-1138-40a9-a1f1-4d2600ca8822", "content": "Patch Tuesday: Microsoft fixed ~1,090 CVEs. One is exploited: Outlook CVE-2026-124194, where a crafted message file connects to an attacker's server with no warning. Patch Office and Windows.\ncyberscoop.com/microsoft-pa...\n#PatchTuesday #Microsoft #cybersecurity", "url": "https://bsky.app/profile/thelabledger.bsky.social/post/3mzymq5e7hs2r"}, {"timestamp": "2026-11-11T00:00:00Z", "date_only": true, "value": "2026-11-11", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1511", "record": "CERTFR-2026-AVI-1511", "field": "vendor_advisories.36.published_at", "linked_record": true}, {"timestamp": "2026-11-11T00:00:47Z", "date_only": false, "value": "2026-11-11T00:00:47.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/VulnerabilityNews/45362", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "842ce0e3-7f91-444d-9bf1-976dfd1cdc22", "content": "CISA Adds Six Known Exploited Vulnerabilities to Catalog\n\nCISA has added six new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.\nCVE-2026-20320 Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability\u00a0\nCVE-2026-111560 Barracuda Networks Multiple Products OS Command Injection Vulnerability\u00a0\nCVE-2026-111793 Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability\u00a0\nCVE-2026-116606 Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability\u00a0\nCVE-2026-124194 Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability\u00a0\nCVE-2026-125350 Google Chromium Use-After-Free Vulnerability\u00a0\nThese types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.\nBinding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA\u2019s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied.\nWhile BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.\nAware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA\u2019s KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.\nhttps://www.cisa.gov/news-events/alerts/2026/11/10/cisa-adds-six-known-exploited-vulnerabilities-catalog", "url": "https://t.me/VulnerabilityNews/45362", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-11-11T00:00:47Z", "date_only": false, "value": "2026-11-11T00:00:47.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/VulnerabilityNews/45362", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "3ef13a6f-69a4-4802-9268-b6aff06f947f", "content": "CISA Adds Six Known Exploited Vulnerabilities to Catalog\n\nCISA has added six new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.\nCVE-2026-20320 Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability\u00a0\nCVE-2026-111560 Barracuda Networks Multiple Products OS Command Injection Vulnerability\u00a0\nCVE-2026-111793 Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability\u00a0\nCVE-2026-116606 Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability\u00a0\nCVE-2026-124194 Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability\u00a0\nCVE-2026-125350 Google Chromium Use-After-Free Vulnerability\u00a0\nThese types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.\nBinding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA\u2019s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied.\nWhile BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.\nAware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA\u2019s KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.\nhttps://www.cisa.gov/news-events/alerts/2026/11/10/cisa-adds-six-known-exploited-vulnerabilities-catalog", "url": "https://t.me/VulnerabilityNews/45362"}, {"timestamp": "2026-11-11T00:33:09.222Z", "date_only": false, "value": "2026-11-11T00:33:09.222279Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117594992724050236", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "8275a6db-8536-43f2-b208-4ca9a4d7318c", "content": "CVE-2026-124194 Microsoft Outlook Spoofing Vulnerability Product ui does not warn user of unsafe actions in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.\nhttps://www.cve.org/CVERecord?id=CVE-2026-124194https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-124194#microsoft #Microsoft #Microsoft365AppsforEnterprise #MicrosoftOfficeLTSC2021 #MicrosoftOfficeLTSC2024#CVE_2026_124194#bot", "url": "https://infosec.exchange/users/cve/statuses/117594992724050236"}, {"timestamp": "2026-11-11T01:14:55Z", "date_only": false, "value": "2026-11-11T01:14:55.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.cert.dk/news/2026-11-10/November-Patch-Tuesday-Outlook-0-dag-og-kritiske-fejl-i-Exchange-SharePoint-og-LDAP", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "83cc2881-ca80-4265-a63f-0d21d27134f5", "url": "https://www.cert.dk/news/2026-11-10/November-Patch-Tuesday-Outlook-0-dag-og-kritiske-fejl-i-Exchange-SharePoint-og-LDAP"}, {"timestamp": "2026-11-11T01:24:11.071Z", "date_only": false, "value": "2026-11-11T01:24:11.071142Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mzysaockbv27", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "229c030a-6f30-402d-9266-1b7d2ddf9ebb", "content": "Microsoft addressed 1,093 vulnerabilities, including 63 critical flaws and an actively exploited Outlook spoofing zero-day (CVE-2026-124194). The roundup highlights priority Exchange, SharePoint, Outlook, Windows Search and LDAP flaws and urges prompt patching.", "url": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mzysaockbv27"}, {"timestamp": "2026-11-11T01:47:37.212Z", "date_only": false, "value": "2026-11-11T01:47:37.212534Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/suriq.io/post/3mzytkltrek2l", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "14a21caf-ab8f-4e9a-8406-ddd7cf00b3c6", "content": "\ud83d\udd34 EXPLOITED\n\nCVE-2026-124194: Microsoft has fixed an Outlook spoofing flaw that is listed in CISA KEV as exploited. It affects Microsoft 365 Apps and Office LTSC 2021 and 2024. Apply Microsoft's latest Office security updates; the CISA due date is 2026-11-24.", "url": "https://bsky.app/profile/suriq.io/post/3mzytkltrek2l"}, {"timestamp": "2026-11-11T02:00:07Z", "date_only": false, "value": "2026-11-11T02:00:07.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/110036", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "c24e89e9-587c-435d-891e-3b8abc97eb4f", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-124194-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a AmesianX\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-11-11 01:37:18\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-124194 PoC - Outlook spoofing/forced-authentication NTLM leak (patched 2026-11). Concept proof only, untested against vulnerable Outlook.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/110036", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-11-11T02:00:07Z", "date_only": false, "value": "2026-11-11T02:00:07.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/110036", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "dc4284aa-0d45-4955-b088-d22e50daf17a", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-124194-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a AmesianX\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-11-11 01:37:18\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-124194 PoC - Outlook spoofing/forced-authentication NTLM leak (patched 2026-11). Concept proof only, untested against vulnerable Outlook.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/110036"}, {"timestamp": "2026-11-11T02:01:05.139Z", "date_only": false, "value": "2026-11-11T02:01:05.139613Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/sansisc.bsky.social/post/3mzyucnwgvp2s", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "0b6193d0-ee2c-461c-8627-959e21b1bd93", "content": "SANS Stormcast Wednesday, November 11th, 2026: Microsoft Patch Tuesday Outlook Spoofing (CVE-2026-124194); Apple Bluetooth and iMessage Fixes; SAP NetWeaver CVSS 10s (CVE-2026-89103)\n https://isc.sans.edu/podcastdetail/10174", "url": "https://bsky.app/profile/sansisc.bsky.social/post/3mzyucnwgvp2s"}, {"timestamp": "2026-11-11T02:43:04.288Z", "date_only": false, "value": "2026-11-11T02:43:04.288577Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/christian1994-94.bsky.social/post/3mzywnqyvu625", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "5d6a2493-c214-4c38-bd59-7f0f70ff1e92", "content": "VolatiAI \u2014 4 new signals\n\n\u2022 13f-holdings (2): Kailix Advisors LLC, THOROUGHBRED FINANCIAL SERVICES, LLC\n\u2022 jobs (1): Senior Software Engineer \u00e2\u0080\u0094 Kubernetes Contr\n\u2022 security (1): CVE-2026-124194 \u2014 Microsoft Office Outlook Mi\n\nFull: christianscode1994.github.io/VolatiAI/brief.html", "url": "https://bsky.app/profile/christian1994-94.bsky.social/post/3mzywnqyvu625"}, {"timestamp": "2026-11-11T03:06:41.228Z", "date_only": false, "value": "2026-11-11T03:06:41.228408Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/chuiho.net/post/3mzyxxxifoz2w", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "5fe0d498-d0af-43f3-8886-532b8e9e1af0", "content": "\ud83d\udea8\u901f\u5831\uff3b\u8b66\u6212\uff3d2026\u5e7411\u6708\u306eMicrosoft\u6708\u4f8b\u66f4\u65b0\u3001Outlook\u6b20\u9665\u306f\u60aa\u7528\u6e08\u307f\nJPCERT/CC \u304c\u6ce8\u610f\u559a\u8d77\u3057\u305f2026\u5e7411\u6708\u306e\u30de\u30a4\u30af\u30ed\u30bd\u30d5\u30c8 \u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u66f4\u65b0\u30d7\u30ed\u30b0\u30e9\u30e0\u3002\u60aa\u7528\u304c\u78ba\u8a8d\u3055\u308c\u305f CVE-2026-124194\uff08Outlook\uff09\u3068\u3001\u66f4\u65b0\u306e\u78ba\u304b\u3081\u65b9\u3092\u6574\u7406\u3059\u308b\u3002\nhttps://chuiho.net/posts/ms-november-2026-update-jpcert/ #Microsoft #\u6708\u4f8b\u66f4\u65b0", "url": "https://bsky.app/profile/chuiho.net/post/3mzyxxxifoz2w"}, {"timestamp": "2026-11-11T03:13:43Z", "date_only": false, "value": "2026-11-11T03:13:43.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.acn.gov.it/portale/w/aggiornamenti-mensili-microsoft-26", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "8c5ae658-b0a9-4cec-a5be-b9350ecce24f", "url": "https://www.acn.gov.it/portale/w/aggiornamenti-mensili-microsoft-26"}, {"timestamp": "2026-11-11T03:38:18Z", "date_only": false, "value": "2026-11-11T03:38:18.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/ViralCyber/27384", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "98b5dd17-aff2-4852-924d-0acc2db6ee0d", "content": "\ud83d\udcf5\u0647\u0634\u062f\u0627\u0631 \u0627\u0645\u0646\u06cc\u062a\u06cc \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a\u061b \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0628\u062d\u0631\u0627\u0646\u06cc \u062f\u0631 Exchange Server \u0648 \u062d\u0645\u0644\u0647 \u0641\u0639\u0627\u0644 \u0628\u0647 Outlook!\n\u25c0\ufe0f\u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0633\u0627\u0639\u0627\u062a\u06cc \u067e\u06cc\u0634 \u062f\u0631 \u0628\u0647\u200c\u0631\u0648\u0632\u0631\u0633\u0627\u0646\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc \u06f1\u06f0 \u0646\u0648\u0627\u0645\u0628\u0631 \u06f2\u06f0\u06f2\u06f6 (Patch Tuesday\u060c \u0627\u0632 \u0627\u0635\u0644\u0627\u062d \u06f1,\u06f0\u06f9\u06f3 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u062c\u062f\u06cc\u062f \u062f\u0631 \u0645\u062d\u0635\u0648\u0644\u0627\u062a \u062e\u0648\u062f \u062e\u0628\u0631 \u062f\u0627\u062f\u0647 \u0627\u0633\u062a.\n\u25c0\ufe0f\u062f\u0631 \u0627\u06cc\u0646 \u0628\u0647\u200c\u0631\u0648\u0632\u0631\u0633\u0627\u0646\u06cc\u060c \u06f9 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 Microsoft Exchange Server \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u0648 \u0627\u0635\u0644\u0627\u062d \u0634\u062f\u0647\u200c\u0627\u0646\u062f:\n\ud83d\udd34 \u06f2 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0627\u062c\u0631\u0627\u06cc \u06a9\u062f \u0627\u0632 \u0631\u0627\u0647 \u062f\u0648\u0631 (RCE)\n\ud83d\udd34 \u06f4 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0627\u0641\u0632\u0627\u06cc\u0634 \u0633\u0637\u062d \u062f\u0633\u062a\u0631\u0633\u06cc (Privilege Escalation)\n\ud83d\udd34 \u06f2 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u062c\u0639\u0644 \u0647\u0648\u06cc\u062a (Spoofing)\n\ud83d\udd34 \u06f1 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0627\u062e\u062a\u0644\u0627\u0644 \u0633\u0631\u0648\u06cc\u0633 (DoS)\n\n\u25c0\ufe0f \u0645\u0647\u0645\u200c\u062a\u0631\u06cc\u0646 \u0645\u0648\u0631\u062f: CVE-2026-118207\n\u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0627\u0632 \u0646\u0648\u0639 Remote Code Execution \u0628\u0627 \u0634\u062f\u062a Critical \u0648 \u0627\u0645\u062a\u06cc\u0627\u0632 CVSS \u0628\u0631\u0627\u0628\u0631 8.8 \u0627\u0633\u062a \u0648 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0628\u0647 \u0645\u0647\u0627\u062c\u0645 \u062f\u0627\u0631\u0627\u06cc \u0633\u0637\u062d \u062f\u0633\u062a\u0631\u0633\u06cc \u0645\u0648\u0631\u062f\u0646\u06cc\u0627\u0632 \u0627\u0645\u06a9\u0627\u0646 \u0627\u062c\u0631\u0627\u06cc \u06a9\u062f \u0631\u0648\u06cc \u0633\u0631\u0648\u0631 Exchange \u0631\u0627 \u0628\u062f\u0647\u062f.\n\u25c0\ufe0f \u06cc\u06a9 Zero-Day \u062f\u0631 Outlook \u0646\u06cc\u0632 \u062f\u0631 \u062d\u0645\u0644\u0627\u062a \u0648\u0627\u0642\u0639\u06cc \u0645\u0648\u0631\u062f \u0633\u0648\u0621\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0642\u0631\u0627\u0631 \u06af\u0631\u0641\u062a\u0647 \u0627\u0633\u062a!\n\u25c0\ufe0f\u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc CVE-2026-124194 \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u0628\u0627 \u0628\u0627\u0632 \u0634\u062f\u0646 \u0641\u0627\u06cc\u0644 \u0622\u0644\u0648\u062f\u0647 \u062a\u0648\u0633\u0637 \u06a9\u0627\u0631\u0628\u0631\u060c \u0628\u0627\u0639\u062b \u0627\u0641\u0634\u0627\u06cc NTLMv2 Hash \u0634\u0648\u062f\u061b \u0627\u0637\u0644\u0627\u0639\u0627\u062a\u06cc \u06a9\u0647 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0628\u0631\u0627\u06cc \u062d\u0645\u0644\u0627\u062a \u0628\u0639\u062f\u06cc \u0628\u0647 \u062d\u0633\u0627\u0628\u200c\u0647\u0627\u06cc \u0633\u0627\u0632\u0645\u0627\u0646\u06cc \u0645\u0648\u0631\u062f \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0642\u0631\u0627\u0631 \u06af\u06cc\u0631\u062f.\n\u26d4\ufe0f \u0647\u0634\u062f\u0627\u0631 \u0628\u0633\u06cc\u0627\u0631 \u0645\u0647\u0645 \u0628\u0631\u0627\u06cc Exchange 2016 \u0648 2019:\n\u25c0\ufe0f\u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0631\u0633\u0645\u0627\u064b \u0627\u0639\u0644\u0627\u0645 \u06a9\u0631\u062f\u0647 \u0627\u06cc\u0646 \u0646\u0633\u062e\u0647\u200c\u0647\u0627 \u062f\u06cc\u06af\u0631 \u062a\u062d\u062a \u0622\u0632\u0645\u0648\u0646\u200c\u0647\u0627\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc \u0648 \u0627\u0646\u062a\u0634\u0627\u0631 \u0648\u0635\u0644\u0647 \u0642\u0631\u0627\u0631 \u0646\u062f\u0627\u0631\u0646\u062f. \u0628\u0646\u0627\u0628\u0631\u0627\u06cc\u0646 \u0646\u0628\u0648\u062f \u0646\u0627\u0645 \u0622\u0646\u200c\u0647\u0627 \u062f\u0631 \u0641\u0647\u0631\u0633\u062a \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc\u200c\u0647\u0627\u06cc \u062c\u062f\u06cc\u062f\u060c \u0628\u0647 \u0645\u0639\u0646\u06cc \u0627\u0645\u0646 \u0628\u0648\u062f\u0646\u0634\u0627\u0646 \u0646\u06cc\u0633\u062a!\n\n\u2705 \u0627\u0642\u062f\u0627\u0645\u0627\u062a \u0636\u0631\u0648\u0631\u06cc:\n- \u0646\u0635\u0628 \u0641\u0648\u0631\u06cc \u0648\u0635\u0644\u0647\u200c\u0647\u0627\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc Exchange SE \u067e\u0633 \u0627\u0632 \u0627\u0631\u0632\u06cc\u0627\u0628\u06cc \u0648 \u0622\u0632\u0645\u0648\u0646\n- \u0628\u0631\u0646\u0627\u0645\u0647\u200c\u0631\u06cc\u0632\u06cc \u0645\u0647\u0627\u062c\u0631\u062a \u0627\u0632 Exchange 2016 \u0648 2019\n- \u0628\u0647\u200c\u0631\u0648\u0632\u0631\u0633\u0627\u0646\u06cc Outlook \u0648 Office\n- \u0628\u0631\u0631\u0633\u06cc \u062f\u0633\u062a\u0631\u0633\u06cc\u200c\u0647\u0627\u06cc \u0645\u062f\u06cc\u0631\u06cc\u062a\u06cc \u0648 \u067e\u0627\u06cc\u0634 \u0631\u0648\u06cc\u062f\u0627\u062f\u0647\u0627\u06cc \u0645\u0634\u06a9\u0648\u06a9\n#Microsoft #ExchangeServer #Outlook #PatchTuesday #CyberSecurity #ZeroDay\n\n\ud83d\udcf1 @PingChannel \n\u062e\u0628\u0631\u060c \u062a\u062d\u0644\u06cc\u0644\u060c \u0627\u0646\u062a\u0642\u0627\u062f - \u0641\u0646\u0627\u0648\u0631\u06cc \u0627\u0637\u0644\u0627\u0639\u0627\u062a\n\ud83c\udd70\ufe0f\ud83c\udd70\ufe0f\ud83c\udd70\ufe0f\ud83c\udd70\ufe0f", "url": "https://t.me/ViralCyber/27384", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-11-11T03:38:18Z", "date_only": false, "value": "2026-11-11T03:38:18.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/ViralCyber/27384", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "5a7a2927-020b-4a26-974f-7bb81ee6114a", "content": "\ud83d\udcf5\u0647\u0634\u062f\u0627\u0631 \u0627\u0645\u0646\u06cc\u062a\u06cc \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a\u061b \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0628\u062d\u0631\u0627\u0646\u06cc \u062f\u0631 Exchange Server \u0648 \u062d\u0645\u0644\u0647 \u0641\u0639\u0627\u0644 \u0628\u0647 Outlook!\n\u25c0\ufe0f\u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0633\u0627\u0639\u0627\u062a\u06cc \u067e\u06cc\u0634 \u062f\u0631 \u0628\u0647\u200c\u0631\u0648\u0632\u0631\u0633\u0627\u0646\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc \u06f1\u06f0 \u0646\u0648\u0627\u0645\u0628\u0631 \u06f2\u06f0\u06f2\u06f6 (Patch Tuesday\u060c \u0627\u0632 \u0627\u0635\u0644\u0627\u062d \u06f1,\u06f0\u06f9\u06f3 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u062c\u062f\u06cc\u062f \u062f\u0631 \u0645\u062d\u0635\u0648\u0644\u0627\u062a \u062e\u0648\u062f \u062e\u0628\u0631 \u062f\u0627\u062f\u0647 \u0627\u0633\u062a.\n\u25c0\ufe0f\u062f\u0631 \u0627\u06cc\u0646 \u0628\u0647\u200c\u0631\u0648\u0632\u0631\u0633\u0627\u0646\u06cc\u060c \u06f9 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 Microsoft Exchange Server \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u0648 \u0627\u0635\u0644\u0627\u062d \u0634\u062f\u0647\u200c\u0627\u0646\u062f:\n\ud83d\udd34 \u06f2 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0627\u062c\u0631\u0627\u06cc \u06a9\u062f \u0627\u0632 \u0631\u0627\u0647 \u062f\u0648\u0631 (RCE)\n\ud83d\udd34 \u06f4 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0627\u0641\u0632\u0627\u06cc\u0634 \u0633\u0637\u062d \u062f\u0633\u062a\u0631\u0633\u06cc (Privilege Escalation)\n\ud83d\udd34 \u06f2 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u062c\u0639\u0644 \u0647\u0648\u06cc\u062a (Spoofing)\n\ud83d\udd34 \u06f1 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0627\u062e\u062a\u0644\u0627\u0644 \u0633\u0631\u0648\u06cc\u0633 (DoS)\n\n\u25c0\ufe0f \u0645\u0647\u0645\u200c\u062a\u0631\u06cc\u0646 \u0645\u0648\u0631\u062f: CVE-2026-118207\n\u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0627\u0632 \u0646\u0648\u0639 Remote Code Execution \u0628\u0627 \u0634\u062f\u062a Critical \u0648 \u0627\u0645\u062a\u06cc\u0627\u0632 CVSS \u0628\u0631\u0627\u0628\u0631 8.8 \u0627\u0633\u062a \u0648 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0628\u0647 \u0645\u0647\u0627\u062c\u0645 \u062f\u0627\u0631\u0627\u06cc \u0633\u0637\u062d \u062f\u0633\u062a\u0631\u0633\u06cc \u0645\u0648\u0631\u062f\u0646\u06cc\u0627\u0632 \u0627\u0645\u06a9\u0627\u0646 \u0627\u062c\u0631\u0627\u06cc \u06a9\u062f \u0631\u0648\u06cc \u0633\u0631\u0648\u0631 Exchange \u0631\u0627 \u0628\u062f\u0647\u062f.\n\u25c0\ufe0f \u06cc\u06a9 Zero-Day \u062f\u0631 Outlook \u0646\u06cc\u0632 \u062f\u0631 \u062d\u0645\u0644\u0627\u062a \u0648\u0627\u0642\u0639\u06cc \u0645\u0648\u0631\u062f \u0633\u0648\u0621\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0642\u0631\u0627\u0631 \u06af\u0631\u0641\u062a\u0647 \u0627\u0633\u062a!\n\u25c0\ufe0f\u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc CVE-2026-124194 \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u0628\u0627 \u0628\u0627\u0632 \u0634\u062f\u0646 \u0641\u0627\u06cc\u0644 \u0622\u0644\u0648\u062f\u0647 \u062a\u0648\u0633\u0637 \u06a9\u0627\u0631\u0628\u0631\u060c \u0628\u0627\u0639\u062b \u0627\u0641\u0634\u0627\u06cc NTLMv2 Hash \u0634\u0648\u062f\u061b \u0627\u0637\u0644\u0627\u0639\u0627\u062a\u06cc \u06a9\u0647 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0628\u0631\u0627\u06cc \u062d\u0645\u0644\u0627\u062a \u0628\u0639\u062f\u06cc \u0628\u0647 \u062d\u0633\u0627\u0628\u200c\u0647\u0627\u06cc \u0633\u0627\u0632\u0645\u0627\u0646\u06cc \u0645\u0648\u0631\u062f \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0642\u0631\u0627\u0631 \u06af\u06cc\u0631\u062f.\n\u26d4\ufe0f \u0647\u0634\u062f\u0627\u0631 \u0628\u0633\u06cc\u0627\u0631 \u0645\u0647\u0645 \u0628\u0631\u0627\u06cc Exchange 2016 \u0648 2019:\n\u25c0\ufe0f\u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0631\u0633\u0645\u0627\u064b \u0627\u0639\u0644\u0627\u0645 \u06a9\u0631\u062f\u0647 \u0627\u06cc\u0646 \u0646\u0633\u062e\u0647\u200c\u0647\u0627 \u062f\u06cc\u06af\u0631 \u062a\u062d\u062a \u0622\u0632\u0645\u0648\u0646\u200c\u0647\u0627\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc \u0648 \u0627\u0646\u062a\u0634\u0627\u0631 \u0648\u0635\u0644\u0647 \u0642\u0631\u0627\u0631 \u0646\u062f\u0627\u0631\u0646\u062f. \u0628\u0646\u0627\u0628\u0631\u0627\u06cc\u0646 \u0646\u0628\u0648\u062f \u0646\u0627\u0645 \u0622\u0646\u200c\u0647\u0627 \u062f\u0631 \u0641\u0647\u0631\u0633\u062a \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc\u200c\u0647\u0627\u06cc \u062c\u062f\u06cc\u062f\u060c \u0628\u0647 \u0645\u0639\u0646\u06cc \u0627\u0645\u0646 \u0628\u0648\u062f\u0646\u0634\u0627\u0646 \u0646\u06cc\u0633\u062a!\n\n\u2705 \u0627\u0642\u062f\u0627\u0645\u0627\u062a \u0636\u0631\u0648\u0631\u06cc:\n- \u0646\u0635\u0628 \u0641\u0648\u0631\u06cc \u0648\u0635\u0644\u0647\u200c\u0647\u0627\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc Exchange SE \u067e\u0633 \u0627\u0632 \u0627\u0631\u0632\u06cc\u0627\u0628\u06cc \u0648 \u0622\u0632\u0645\u0648\u0646\n- \u0628\u0631\u0646\u0627\u0645\u0647\u200c\u0631\u06cc\u0632\u06cc \u0645\u0647\u0627\u062c\u0631\u062a \u0627\u0632 Exchange 2016 \u0648 2019\n- \u0628\u0647\u200c\u0631\u0648\u0632\u0631\u0633\u0627\u0646\u06cc Outlook \u0648 Office\n- \u0628\u0631\u0631\u0633\u06cc \u062f\u0633\u062a\u0631\u0633\u06cc\u200c\u0647\u0627\u06cc \u0645\u062f\u06cc\u0631\u06cc\u062a\u06cc \u0648 \u067e\u0627\u06cc\u0634 \u0631\u0648\u06cc\u062f\u0627\u062f\u0647\u0627\u06cc \u0645\u0634\u06a9\u0648\u06a9\n#Microsoft #ExchangeServer #Outlook #PatchTuesday #CyberSecurity #ZeroDay\n\n\ud83d\udcf1 @PingChannel \n\u062e\u0628\u0631\u060c \u062a\u062d\u0644\u06cc\u0644\u060c \u0627\u0646\u062a\u0642\u0627\u062f - \u0641\u0646\u0627\u0648\u0631\u06cc \u0627\u0637\u0644\u0627\u0639\u0627\u062a\n\ud83c\udd70\ufe0f\ud83c\udd70\ufe0f\ud83c\udd70\ufe0f\ud83c\udd70\ufe0f", "url": "https://t.me/ViralCyber/27384"}, {"timestamp": "2026-11-11T04:06:11.689Z", "date_only": false, "value": "2026-11-11T04:06:11.689946Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mzz3cf3ags2o", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "d2467bc2-16d2-4db0-86ef-63e4059e67df", "content": "@talosintelligence.com\nMicrosoft's November 2026 Patch Tuesday fixes 1,095 vulnerabilities, including 64 critical; Outlook spoofing flaw CVE-2026-124194 is exploited in the wild...\n-\nIOCs: CVE-2026-124194, CVE-2026-113862\n-\n#ExploitedVulnerability #PatchTuesday #ThreatIntel #Vulnerability", "url": "https://bsky.app/profile/cyfar.ca/post/3mzz3cf3ags2o"}, {"timestamp": "2026-11-11T04:25:07.641Z", "date_only": false, "value": "2026-11-11T04:25:07.641955Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/xploitdigest-kev.bsky.social/post/3mzz4eaakke23", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "00b4d874-1d17-4356-9e55-28988cb8fe5b", "content": "Do you run Microsoft Office?\n\nCISA lists CVE-2026-124194 as exploited (added 10 Nov 2026).\n\nCan it reach you? Over a network. It needs no login, and someone has to click or open something. CVSS 6.5.\n\nPlain-English breakdown:\nxploitdigest.com/kev/CVE-2026-124194\n\n#Microsoft #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/xploitdigest-kev.bsky.social/post/3mzz4eaakke23"}, {"timestamp": "2026-11-11T04:35:05.429Z", "date_only": false, "value": "2026-11-11T04:35:05.429656Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/shiojiri.com/post/3mzz4txj5a2mb", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "ad76cc62-a8c7-4c37-8eff-dcc7ead1db63", "content": "\u300c\u3053\u306e\u5185 CVE-2026-124194 \u306e\u8106\u5f31\u6027\u306b\u3064\u3044\u3066\u3001Microsoft \u793e\u3067\u306f\u60aa\u7528\u306e\u4e8b\u5b9f\u3092\u78ba\u8a8d\u6e08\u307f\u3068\u516c\u8868\u3057\u3066\u304a\u308a\u3001\u4eca\u5f8c\u88ab\u5bb3\u304c\u62e1\u5927\u3059\u308b\u304a\u305d\u308c\u304c\u3042\u308b\u305f\u3081\u3001\u81f3\u6025\u3001\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u66f4\u65b0\u30d7\u30ed\u30b0\u30e9\u30e0\u3092\u9069\u7528\u3057\u3066\u304f\u3060\u3055\u3044\u3002\u300d", "url": "https://bsky.app/profile/shiojiri.com/post/3mzz4txj5a2mb"}, {"timestamp": "2026-11-11T04:55:34.393Z", "date_only": false, "value": "2026-11-11T04:55:34.393Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-124194", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-11T05:19:35.990Z", "date_only": false, "value": "2026-11-11T05:19:35.990", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-124194", "record": "FKIE_CVE-2026-124194", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-11-11T06:01:32.710Z", "date_only": false, "value": "2026-11-11T06:01:32.710423Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/raven-sec.bsky.social/post/3mzzbqkry2pc4", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "2c4cc439-a8d0-4381-98e7-2669eca24ec6", "content": "1,260+ vulns, Outlook zero-day live, 37.6M breached\n\n\u2022 CVE-2026-124194 actively exploited now\n\u2022 Nitori: 37.6M customer records stolen\n\u2022 AhsayCBS RCE weaponized with webshells\n\n5 sources verified \u00b7 hackingallthethings.com\n#infosec #threatintel #cybersecurity #PatchTuesday #ZeroDay", "url": "https://bsky.app/profile/raven-sec.bsky.social/post/3mzzbqkry2pc4"}, {"timestamp": "2026-11-11T06:12:10.214Z", "date_only": false, "value": "2026-11-11T06:12:10.214202Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mzzcdmukuy2g", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "c4061644-e4b2-4072-a1b3-c6e0af92918d", "content": "Microsoft patched 1,094 vulnerabilities in its November 2026 updates and says an Outlook spoofing flaw, CVE-2026-124194, was exploited. The flaw could expose authentication information when a user opens a malicious file.", "url": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mzzcdmukuy2g"}, {"timestamp": "2026-11-11T06:28:02.467Z", "date_only": false, "value": "2026-11-11T06:28:02.467266Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybowl.bsky.social/post/3mzzd7yxx5o2k", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "34cf20c8-86de-46a5-afbc-9363c3584fde", "content": "\ud83d\udd34 Exploitation confirm\u00e9e (CISA KEV, ajouts du 10/11) \u00b7 5\n\u2022 Barracuda Networks Multiple Products CVE-2026-111560, CVSS 8.6\n\u2022 Openwave Messaging Limited Webtop Media Transcoder CVE-2026-111793, CVSS 4.3\n\u2022 Microsoft Office CVE-2026-124194, CVSS 6.5\n\u2022 Google Chromium CVE-2026-125350, CVSS 8.8", "url": "https://bsky.app/profile/cybowl.bsky.social/post/3mzzd7yxx5o2k"}, {"timestamp": "2026-11-11T06:28:59.999Z", "date_only": false, "value": "2026-11-11T06:28:59.999176Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/runbooklab.bsky.social/post/3mzzdbqcwfr2k", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "9a9ba5de-0661-4763-89ed-bf4cc09a51d4", "content": "Outlook zero-day CVE-2026-124194 is exploited and in CISA KEV, due 24 Nov. A crafted file can leak the user's NTLMv2 hash.\nDo this: deploy the November Office update.\nCheck: LTSC 2021 16.0.14334.21048, LTSC 2024 16.0.17932.21140\nSource: MSRC Nov 2026\nrunbooklabhq.com/news/outlook...", "url": "https://bsky.app/profile/runbooklab.bsky.social/post/3mzzdbqcwfr2k"}, {"timestamp": "2026-11-11T06:30:25.662Z", "date_only": false, "value": "2026-11-11T06:30:25.662194Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/threatspotai.bsky.social/post/3mzzdeciwep2e", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "ad98ebbb-5c30-4b32-b634-8b07f4892516", "content": "\ud83d\udea8 CISA KEV Alert\nCVE-2026-124194: \u26a0\ufe0f CVE-2026-124194: New Actively Exploited Vulnerability Added to CISA KEV\nSeverity: HIGH | CVSS: 0.0\nActively exploited\n\nRead the full alert: https://threatspot.ai/alerts/2026-124194-product-ui-does-not-warn-user", "url": "https://bsky.app/profile/threatspotai.bsky.social/post/3mzzdeciwep2e"}, {"timestamp": "2026-11-11T06:42:18.327Z", "date_only": false, "value": "2026-11-11T06:42:18.327342Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cvemon.bsky.social/post/3mzzdzjpswv2v", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "a7823c4d-896a-44ee-bfd8-f9cd75e64420", "content": "CVE-2026-124194 is trending. Hype score 30, currently #1 on cvemon.\n\nProduct ui does not warn user of unsafe actions in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.\n\nhttps://cvemon.intruder.io/cves/CVE-2026-124194", "url": "https://bsky.app/profile/cvemon.bsky.social/post/3mzzdzjpswv2v"}, {"timestamp": "2026-11-11T06:56:19.939Z", "date_only": false, "value": "2026-11-11T06:56:19.939640Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/bot-de-florian.bsky.social/post/3mzzesmtreq2i", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "d570b737-f75a-40ee-80bd-c8546b3eec8e", "content": "\ud83d\udee1\ufe0f Revue cyber du 11 nov. : Patch Tuesday hors norme chez Microsoft \u2014 ~1 100 failles corrig\u00e9es, 63 critiques, dont un zero-day Outlook (CVE-2026-124194) d\u00e9j\u00e0 exploit\u00e9. https://krebsonsecurity.com/2026/11/microsoft-fixes-nearly-1100-security-vulnerabilities/", "url": "https://bsky.app/profile/bot-de-florian.bsky.social/post/3mzzesmtreq2i"}, {"timestamp": "2026-11-11T08:00:01Z", "date_only": false, "value": "2026-11-11T08:00:01+00:00", "kind": "kev", "label": "Recorded", "source": "previdian", "record": "CVE-2026-124194", "field": "timestamps.recorded_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "9d6c1725-27e8-4c4e-9004-e9499278552a", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-11-11T08:00:30.894Z", "date_only": false, "value": "2026-11-11T08:00:30.894884Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/9d6c1725-27e8-4c4e-9004-e9499278552a", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "b2311a40-a46e-4219-8f17-45d6f1390242", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/9d6c1725-27e8-4c4e-9004-e9499278552a", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-11-11T08:01:36.113Z", "date_only": false, "value": "2026-11-11T08:01:36.113908Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thebadgamer.bsky.social/post/3mzzihcm5ed2w", "record": "cve-2026-124194", "field": "creation_timestamp", "uuid": "a31e0624-ae8a-43ba-9d81-4cbee336a1e8", "content": "Outlook's November update addresses an exploited spoofing flaw that can expose authentication information; NVD still publishes no fixed version for verification.\u2026\nhttps://www.trickyworld.in/computer-tricks/cyber-security/cve-2026-124194-outlook-fix-exploited-spoofing/?utm_medium=social", "url": "https://bsky.app/profile/thebadgamer.bsky.social/post/3mzzihcm5ed2w"}, {"timestamp": "2026-11-11T08:36:31.894Z", "date_only": false, "value": "2026-11-11T08:36:31.894081Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mzzkfrztfo24", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "3193f523-3434-44b4-be5a-b87ab0c2dd6a", "content": "Microsoft Outlook\u306e\u30bc\u30ed\u30c7\u30a4\u8106\u5f31\u6027\u304c\u60aa\u7528\u3055\u308c\u308b\u3001NTLM\u8a8d\u8a3c\u60c5\u5831\u3092\u7a83\u53d6\u3059\u308b\u653b\u6483\u3092\u78ba\u8a8d\n\nMicrosoft\u306f\u3001\u5b9f\u969b\u306b\u60aa\u7528\u3055\u308c\u3066\u3044\u308bOutlook\u306e\u306a\u308a\u3059\u307e\u3057\uff08\u30b9\u30d7\u30fc\u30d5\u30a3\u30f3\u30b0\uff09\u306e\u8106\u5f31\u6027\u300cCVE-2026-124194\u300d\u3092\u4fee\u6b63\u3057\u307e\u3057\u305f\u3002\u3053\u306e\u8106\u5f31\u6027\u3092\u7a81\u304b\u308c\u308b\u3068\u3001\u30e1\u30fc\u30eb\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u304c\u653b\u6483\u8005\u306e\u7ba1\u7406\u3059\u308b\u30a4\u30f3\u30d5\u30e9\u306bNTLMv2\u306e\u8a8d\u8a3c\u60c5\u5831\u3092\u9001\u4fe1\u3057\u3066\u3057\u307e\u3044\u307e\u3059\u3002 \u4fee\u6b63\u30d7\u30ed\u30b0\u30e9\u30e0\u306f2026\u5e7411\u670810\u65e5\u306b\u516c\u958b\u3055\u308c\u307e\u3057\u305f\u3002\u6df1", "url": "https://bsky.app/profile/blackhatnews.tokyo/post/3mzzkfrztfo24"}, {"timestamp": "2026-11-11T08:44:00.094Z", "date_only": false, "value": "2026-11-11T08:44:00.094346Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/undercodenews.bsky.social/post/3mzzkt4lqay2w", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "c9240d9c-7d34-4100-b6b6-3ba9bce4c828", "content": "Microsoft Patches Actively Exploited Outlook Zero-Day That Steals NTLMv2 Credentials Without\u00a0Warning\n\nIntroduction: A Silent Outlook Connection Exposes Windows Credentials Microsoft has patched an actively exploited Outlook security vulnerability, tracked as CVE-2026-124194, that allows attackers\u2026", "url": "https://bsky.app/profile/undercodenews.bsky.social/post/3mzzkt4lqay2w"}, {"timestamp": "2026-11-11T08:51:02.134Z", "date_only": false, "value": "2026-11-11T08:51:02.134731Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hey-kira.bsky.social/post/3mzzl7q3mar2g", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "c640b796-e108-4545-91ab-69d3a1dd5c60", "content": "Same 10 Nov wave, different queue: MSRC marks the Outlook flaw CVE-2026-124194 as Exploitation Detected. If that patch and your NTLM auditing compete for one maintenance window, the zero-day goes first - your enforcement date is May 2027, this one is already being exploited.", "url": "https://bsky.app/profile/hey-kira.bsky.social/post/3mzzl7q3mar2g"}, {"timestamp": "2026-11-11T08:55:12.409Z", "date_only": false, "value": "2026-11-11T08:55:12.409595Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/vulnidx-jp.bsky.social/post/3mzzlh6v7hk2f", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "03aaa1ad-ec97-498b-9a06-0cd23fc266e4", "content": "\u3010\u65e5\u672c\u8a9e\u306e\u516c\u5f0f\u60c5\u5831\u3011CVE-2026-124194\n\u30de\u30a4\u30af\u30ed\u30bd\u30d5\u30c8\u306eMicrosoft 365 Apps\u7b49\u306e\u8907\u6570\u88fd\u54c1\u306b\u304a\u3051\u308b\u30e6\u30fc\u30b6\u306b\u3088\u308b\u5371\u967a\u306a\u30a2\u30af\u30b7\u30e7\u30f3\u306b\u5bfe\u3059\u308b\u8b66\u544a\u306e\u975e\u8868\u793a\u306b\u95a2\u3059\u308b\u8106\u5f31\u6027\nCISA \u306e\u60aa\u7528\u78ba\u8a8d\uff0811/10\uff09\u306e\u5f8c\u3001JVN \u304c\u65e5\u672c\u8a9e\u306e\u516c\u5f0f\u60c5\u5831\u3092\u516c\u958b\nhttps://jvndb.jvn.jp/ja/contents/2026/JVNDB-2026-042906.html\n#\u8106\u5f31\u6027 #Microsoft", "url": "https://bsky.app/profile/vulnidx-jp.bsky.social/post/3mzzlh6v7hk2f"}, {"timestamp": "2026-11-11T09:28:59.040Z", "date_only": false, "value": "2026-11-11T09:28:59.040506Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/mascarpone79.bsky.social/post/3mzzndkponl2r", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "1b3cf96d-3e57-4837-b1ba-7ec4e26b2423", "content": "Microsoft ha revelado una vulnerabilidad en Outlook (CVE-2026-124194, CVSS 6.5) que est\u00e1 siendo explotada activamente. El fallo permite a atacantes no autenticados enga\u00f1ar a los usuarios para que abran archivos de Office maliciosos, lo que", "url": "https://bsky.app/profile/mascarpone79.bsky.social/post/3mzzndkponl2r"}, {"timestamp": "2026-11-11T09:47:37.215Z", "date_only": false, "value": "2026-11-11T09:47:37.215757Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/gadgetry.bsky.social/post/3mzzoevnsmk2r", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "623417ed-3f61-499e-b928-e395837fddf0", "content": "1,259 vulnerabilities patched in November 2026, second consecutive month over 1,000. CVE-2026-124194 (CVSS 6.5) is exploited in the wild, and CISA set 24 November 2026 as the deadline for federal agencies. #CyberSecurity", "url": "https://bsky.app/profile/gadgetry.bsky.social/post/3mzzoevnsmk2r"}, {"timestamp": "2026-11-11T10:54:52.156Z", "date_only": false, "value": "2026-11-11T10:54:52.156889Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/tecnologiageek.com/post/3mzzs55nuxy25", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "869f2c59-ee9a-4bde-bbf7-34d301a6cb63", "content": "Fallo de Outlook CVE-2026-124194 filtra el hash\u00a0NTLMv2\n\nFallo de Outlook CVE-2026-124194 ya explotado: abrir un archivo filtra el hash NTLMv2. CISA pone el parche antes del 24 de noviembre....", "url": "https://bsky.app/profile/tecnologiageek.com/post/3mzzs55nuxy25"}, {"timestamp": "2026-11-11T12:07:27.070Z", "date_only": false, "value": "2026-11-11T12:07:27.070872Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stridingtech.bsky.social/post/3mzzw6xbqyd25", "record": "cve-2026-124194", "field": "creation_timestamp", "uuid": "bdf9248a-f6a9-40ba-aabf-bdf3f1990e05", "content": "Microsoft Outlook's CVE-2026-124194 bypasses user interaction, enabling unprompted actions. Remediation guide.\n#Cybersecurity #Outlook\nhttps://stridingtech.com/archives/cve-2026-124194-remediation-guide-fixing-microsoft-office-outlooks-missing-user-interaction-vulnerability/", "url": "https://bsky.app/profile/stridingtech.bsky.social/post/3mzzw6xbqyd25"}, {"timestamp": "2026-11-11T12:11:22.396Z", "date_only": false, "value": "2026-11-11T12:11:22.396853Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mzzwfxg4332w", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "cd647b0b-faab-484d-81ad-b8a0a537ddc5", "content": "\ud83e\udd16 Nov Patch Tuesday: 1,259 Microsoft fixes. Key one is CVE-2026-124194 (CVSS 6.5): a crafted file makes Outlook fetch an attacker resource and leak the NTLMv2 hash. Actively exploited, CISA KEV, fix by Nov 24.\nhttps://thehackernews.com/2026/11/microsoft-patches-1259-flaws-including.html", "url": "https://bsky.app/profile/newssecia.bsky.social/post/3mzzwfxg4332w"}, {"timestamp": "2026-11-11T12:15:38.411Z", "date_only": false, "value": "2026-11-11T12:15:38.411691Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/basttech.bsky.social/post/3mzzwnl7rs224", "record": "cve-2026-124194", "field": "creation_timestamp", "uuid": "bb9bbcfb-65d7-4239-bd91-9898e6f8ea68", "content": "Outlook-h\u00e5l har utnyttjats: uppdatera Office p\u00e5 datorn\n\nMicrosoft s\u00e4ger att ett Outlook-h\u00e5l har utnyttjats i attacker. Se vilka Office-versioner som ber\u00f6rs och hur du kontrollerar uppdateringen p\u00e5 datorn.\n\nb\u00e4sttech.se/sakerhet/outlook-cve-2026-124194-uppdatera-office/", "url": "https://bsky.app/profile/basttech.bsky.social/post/3mzzwnl7rs224"}, {"timestamp": "2026-11-11T12:28:11.419Z", "date_only": false, "value": "2026-11-11T12:28:11.419200Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/sadtheheadmod.bsky.social/post/3mzzxdzj2bt2n", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "d92dd966-b520-4e64-a683-a36a246ac84d", "content": "Microsoft Outlook CVE-2026-124194 bypasses user interaction, enabling unprompted actions. Audit logs must record any anomalous processes. Delay in patching invites compromise.", "url": "https://bsky.app/profile/sadtheheadmod.bsky.social/post/3mzzxdzj2bt2n"}, {"timestamp": "2026-11-11T12:30:07.523Z", "date_only": false, "value": "2026-11-11T12:30:07.523635Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mzzxhifmk72y", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "dacfbd8c-3397-47b6-9df0-37cb30f73da3", "content": "\ud83d\udce2 [VULN] Patch Tuesday Novembre 2026 \u2013 1093 CVE - CVE-2026-124194 (faille Outlook exploit\u00e9e)\n\nLe 10 novembre 2026, Microsoft corrige 1 093 vuln\u00e9rabilit\u00e9s, son deuxi\u00e8me volume mensuel apr\u00e8s le record d\u2019octobre, dont une seule est exploit\u00e9e : la CVE-2026-124194, une \u2026\n\n#Vuln\u00e9rabilit\u00e9 #CVE #Cyberveille", "url": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mzzxhifmk72y"}, {"timestamp": "2026-11-11T12:46:55.567Z", "date_only": false, "value": "2026-11-11T12:46:55.567492Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/intcyberdigest.bsky.social/post/3mzzyfjrspv2p", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "5967178f-3517-41af-8748-6e8a5ae66c25", "content": "Microsoft says the file makes Outlook quietly connect to an attacker's server, with no warning, and leak the user's NTLMv2 login hash. The Preview Pane is not a way in.\n\nThe flaw, CVE-2026-124194, is one of more than 1,000 fixed in Patch Tuesday today.", "url": "https://bsky.app/profile/intcyberdigest.bsky.social/post/3mzzyfjrspv2p"}, {"timestamp": "2026-11-11T13:33:15.297Z", "date_only": false, "value": "2026-11-11T13:33:15.297159Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/qdtsignallab.bsky.social/post/3n222ybysy22u", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "f9d1aa4d-6f1f-46ba-b101-c6b7f26a28ea", "content": "CISA added 295 entries to its Known Exploited Vulnerabilities catalog in 2026 (Nov 10 version). Six on Nov 10 alone, incl. Chrome CVE-2026-125350 and Outlook CVE-2026-124194. Free JSON/CSV, no key.\nsignal-lab.qdt.ai/datasets/cis...", "url": "https://bsky.app/profile/qdtsignallab.bsky.social/post/3n222ybysy22u"}, {"timestamp": "2026-11-11T14:13:52.457Z", "date_only": false, "value": "2026-11-11T14:13:52.457495Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/sadtheheadmod.bsky.social/post/3n225aysixy2c", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "7e8341bf-2d4d-4757-9772-2860e8d1048f", "content": "Outlook CVE-2026-124194 exploits unsupervised execution; patch within 24h or risk unnoticed damage. Log all anomalous processes; retention of 90 days stops attackers from sanitizing evidence. Failure to act guarantees breach.", "url": "https://bsky.app/profile/sadtheheadmod.bsky.social/post/3n225aysixy2c"}, {"timestamp": "2026-11-11T14:23:12.055Z", "date_only": false, "value": "2026-11-11T14:23:12.055+00:00", "kind": "other", "label": "Document generated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4479", "record": "WID-SEC-W-2026-4479", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2026-11-11T14:23:20Z", "date_only": false, "value": "2026-11-11T14:23:20.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/true_secator/8800", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "20990032-34b7-426f-b3e1-496d505988cd", "content": "Microsoft \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044e\u0442 \u0432\u043d\u0435\u0434\u0440\u044f\u0442\u044c \u0418\u0418 \u0432 \u0441\u0432\u043e\u044e \u0440\u0430\u0431\u043e\u0442\u0443, \u0432\u044b\u043a\u0430\u0442\u0438\u0432 PatchTuesday \u0437\u0430 \u043d\u043e\u044f\u0431\u0440\u044c 2026 \u0433\u043e\u0434\u0430 \u0441 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u0440\u0435\u043a\u043e\u0440\u0434\u043d\u044b\u0445 1235 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u043e\u0434\u043d\u0443 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u0443\u044e 0-day \u0432 Microsoft Outlook.\n\n\u0412 \u044d\u0442\u043e\u043c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b 66 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, 48 \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0442 \u0441\u043e\u0431\u043e\u0439 RCE, 15 - EoP, \u0438 3 - use-After-Free \u0432 Microsoft Edge.\n\n\u0415\u0441\u043b\u0438 \u043f\u043e \u043a\u0430\u0442\u0435\u0433\u043e\u0440\u0438\u044f\u043c: 536 - EoP, 27 - \u043e\u0431\u0445\u043e\u0434 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, 296 - RCE, 157 -  \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u0435 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438, 46 - DoS, 22 - \u043f\u043e\u0434\u043c\u0435\u043d\u0430 \u0434\u0430\u043d\u043d\u044b\u0445, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0435\u0449\u0435 142 - \u0432 Microsoft Edge (\u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 Chromium). \u0418\u0437 1235 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043f\u0440\u0438\u043c\u0435\u0440\u043d\u043e 639 \u043e\u0442\u043d\u043e\u0441\u044f\u0442\u0441\u044f \u043a Microsoft Windows \u0438\u043b\u0438 \u0435\u0433\u043e \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430\u043c.\n\n\u0412 \u044d\u0442\u043e\u043c \u043c\u0435\u0441\u044f\u0446\u0435 \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 PatchTuesday \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u043e\u0434\u043d\u0430 0-day \u0432 Microsoft Outlook, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0430\u0441\u044c \u0432 \u0430\u0442\u0430\u043a\u0430\u0445.\n\n\u0420\u0435\u0447\u044c \u0438\u0434\u0435\u0442 \u043e CVE-2026-124194, \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u043e\u0434\u043c\u0435\u043d\u044b \u0432 Microsoft Outlook, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0430\u0441\u044c \u0434\u043b\u044f \u043a\u0440\u0430\u0436\u0438 \u0445\u0435\u0448\u0435\u0439 \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0437\u0430\u043f\u0438\u0441\u0435\u0439 NTLM.\n\nMicrosoft \u043f\u0440\u0438\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442 \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c nono \u0438 \u0411\u0435\u043d\u0443\u0430 \u0421\u0435\u0432\u0435\u043d\u0441\u0443. \u0412 \u0431\u043b\u0430\u0433\u043e\u0434\u0430\u0440\u043d\u043e\u0441\u0442\u0438 \u0421\u0435\u0432\u0435\u043d\u0441\u0443 \u0443\u043f\u043e\u043c\u0438\u043d\u0430\u0435\u0442\u0441\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u043c\u043e\u0434\u0435\u043b\u0438 Claude \u043e\u0442 Anthropic.\n\n\u041d\u0435\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u044b\u0439 \u0444\u0430\u0439\u043b \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f \u0438 \u0443\u0431\u0435\u0434\u0438\u0442\u044c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u043e\u0442\u043a\u0440\u044b\u0442\u044c \u0435\u0433\u043e \u0432 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438 Microsoft Outlook.\n\n\u042d\u0442\u043e \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0442\u043e\u043c\u0443, \u0447\u0442\u043e Outlook \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u0441\u044f \u043a \u0441\u0435\u0442\u0435\u0432\u043e\u043c\u0443 \u0440\u0430\u0441\u043f\u043e\u043b\u043e\u0436\u0435\u043d\u0438\u044e, \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u043e\u043c\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u043c, \u0431\u0435\u0437 \u043e\u0442\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u044f \u043e\u0431\u044b\u0447\u043d\u043e\u0433\u043e \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u044f \u043e \u0432\u043d\u0435\u0448\u043d\u0435\u043c \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0435, \u0447\u0442\u043e \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043c\u043e\u0436\u0435\u0442 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u044c \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u0434\u043b\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0434\u043b\u044f \u0432\u044b\u0434\u0430\u0447\u0438 \u0441\u0435\u0431\u044f \u0437\u0430 \u0434\u0440\u0443\u0433\u043e\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f.\n\n\u0414\u043b\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u0441\u0435\u0442\u0435\u0432\u043e\u0435 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0435 \u0438 \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0435 \u0441 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c \u042d\u0442\u043e\u0442 \u0442\u0438\u043f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0438\u0437\u0432\u0435\u0441\u0442\u0435\u043d \u043a\u0430\u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u044f \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 NTLM, \u043f\u0440\u0438 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u0432\u043b\u043e\u0436\u0435\u043d\u0438\u0435 \u043f\u0440\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u0438 \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442 \u043a \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044e Windows \u043a \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u043f\u0430\u043f\u043a\u0435, \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u043e\u0439 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u043c.\n\n\u041f\u0440\u0438 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 Windows \u043c\u043e\u0436\u0435\u0442 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u043f\u043e\u043f\u044b\u0442\u0430\u0442\u044c\u0441\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u043d\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435, \u0440\u0430\u0441\u043a\u0440\u044b\u0432\u0430\u044f \u0445\u044d\u0448 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f NTLMv2, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0437\u0430\u0442\u0435\u043c \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0447\u0435\u043d \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u043c \u0438 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0432\u0437\u043b\u043e\u043c\u0430\u043d \u0432 \u0430\u0432\u0442\u043e\u043d\u043e\u043c\u043d\u043e\u043c \u0440\u0435\u0436\u0438\u043c\u0435.\n\n\u041f\u043e\u043b\u0443\u0447\u0435\u043d\u043d\u044b\u0435 \u0443\u0447\u0435\u0442\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u0437\u0430\u0442\u0435\u043c \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u044b \u0434\u043b\u044f \u043d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u043c \u0430\u043a\u043a\u0430\u0443\u043d\u0442\u0430\u043c.\n\n\u0410\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0443\u0436\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u0432 \u043f\u0440\u043e\u0448\u043b\u043e\u043c, \u043a\u0430\u043a \u043f\u0440\u0430\u0432\u0438\u043b\u043e, \u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e\u043c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u0432\u043b\u043e\u0436\u0435\u043d\u0438\u0439, \u0440\u0430\u0441\u0441\u044b\u043b\u0430\u0435\u043c\u044b\u0445 \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0445 \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0439.\n\n\u041f\u043e\u043b\u043d\u043e\u0435 \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0435\u043c \u043a\u0430\u0436\u0434\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0438 \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044b\u0445 \u0435\u044e \u0441\u0438\u0441\u0442\u0435\u043c - \u0437\u0434\u0435\u0441\u044c.", "url": "https://t.me/true_secator/8800"}, {"timestamp": "2026-11-11T14:35:41.154Z", "date_only": false, "value": "2026-11-11T14:35:41.154063Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/heygalatea.com/post/3n226hypfgw2a", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "b5fe5bc2-9155-4d96-8f76-b53cd55fb4fc", "content": "Microsoft patched over 1,000 bugs yesterday. One is exploited, and it's a 6.5.\n\nOutlook CVE-2026-124194: open a crafted message file and it leaks your NTLMv2 hash. Preview Pane isn't a way in.\n\nhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-124194\n\n#PatchTuesday #Outlook #infosec", "url": "https://bsky.app/profile/heygalatea.com/post/3n226hypfgw2a"}, {"timestamp": "2026-11-11T14:55:26.085Z", "date_only": false, "value": "2026-11-11T14:55:26.085199Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/sadtheheadmod.bsky.social/post/3n227l3cw7k2k", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "6d8cd83b-427c-497e-ae92-a636bbd99134", "content": "CVE-2026-124194 exploits unsupervised execution; logs must persist 90 days to salvage evidence. Patch by 12/02, else breach inevitable.", "url": "https://bsky.app/profile/sadtheheadmod.bsky.social/post/3n227l3cw7k2k"}, {"timestamp": "2026-11-11T15:11:48.281Z", "date_only": false, "value": "2026-11-11T15:11:48.281596Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/windowspost.com/post/3n22aiktqns2h", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "3d5ccc06-0721-47e1-b4d4-970e710ffe38", "content": "Microsoft November 2026 Patch Tuesday Fixes 1,093 Vulnerabilities, including an Outlook Zero-Day (CVE-2026-124194) that can leak a user\u2019s NTLMv2 authentication hash to an attacker. Read more: www.windowscult.com/microsoft-pa...\n\n#PatchTuesday #security #UpdateNews #Microsoft", "url": "https://bsky.app/profile/windowspost.com/post/3n22aiktqns2h"}, {"timestamp": "2026-11-11T21:09:05.015Z", "date_only": false, "value": "2026-11-11T21:09:05.015213Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3n22ugsvwqs2h", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "0984c53c-c7b4-4e5d-9d78-16d241b9c536", "content": "4/7 Patch Tuesday: 1,000+ Microsoft fixes, incl. exploited Outlook zero-day CVE-2026-124194 that leaks NTLMv2 hashes (password fingerprints). Finder\u2019s credit mentions Claude. (SecurityWeek)", "url": "https://bsky.app/profile/sergioiker.bsky.social/post/3n22ugsvwqs2h"}, {"timestamp": "2026-11-11T21:09:06.108Z", "date_only": false, "value": "2026-11-11T21:09:06.108994Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3n22uhgqej22h", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "36fbe69d-9177-4226-8322-bc8162dfca52", "content": "4/7 Patch Tuesday: 1,000+ Microsoft fixes, incl. exploited Outlook zero-day CVE-2026-124194 that leaks NTLMv2 hashes (password fingerprints). Finder\u2019s credit mentions Claude. (SecurityWeek)", "url": "https://bsky.app/profile/sergioiker.bsky.social/post/3n22uhgqej22h"}, {"timestamp": "2026-11-11T21:09:07.108Z", "date_only": false, "value": "2026-11-11T21:09:07.108977Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3n22uhgqhgs2h", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "41cf43d1-7abd-4b1e-9a3e-b84b540850f0", "content": "4/7 Patch Tuesday: 1,000+ Microsoft fixes, incl. exploited Outlook zero-day CVE-2026-124194 that leaks NTLMv2 hashes (password fingerprints). Finder\u2019s credit mentions Claude. (SecurityWeek)", "url": "https://bsky.app/profile/sergioiker.bsky.social/post/3n22uhgqhgs2h"}, {"timestamp": "2026-11-11T21:09:08.057Z", "date_only": false, "value": "2026-11-11T21:09:08.057068Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3n22uhgqpas2h", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "807e8c22-bb86-477b-a81a-943f13ce3864", "content": "4/7 Patch Tuesday: 1,000+ Microsoft fixes, incl. exploited Outlook zero-day CVE-2026-124194 that leaks NTLMv2 hashes (password fingerprints). Finder\u2019s credit mentions Claude. (SecurityWeek)", "url": "https://bsky.app/profile/sergioiker.bsky.social/post/3n22uhgqpas2h"}, {"timestamp": "2026-11-11T21:09:09.031Z", "date_only": false, "value": "2026-11-11T21:09:09.031483Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3n22uhgqu522h", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "8e62d8f2-58ac-425d-9576-71cf2bbbe0ef", "content": "4/7 Patch Tuesday: 1,000+ Microsoft fixes, incl. exploited Outlook zero-day CVE-2026-124194 that leaks NTLMv2 hashes (password fingerprints). Finder\u2019s credit mentions Claude. (SecurityWeek)", "url": "https://bsky.app/profile/sergioiker.bsky.social/post/3n22uhgqu522h"}, {"timestamp": "2026-11-11T21:09:10.010Z", "date_only": false, "value": "2026-11-11T21:09:10.010906Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3n22uhgr3x22h", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "97d9b5bb-af90-4b75-8088-7f7a7334b4c9", "content": "4/7 Patch Tuesday: 1,000+ Microsoft fixes, incl. exploited Outlook zero-day CVE-2026-124194 that leaks NTLMv2 hashes (password fingerprints). Finder\u2019s credit mentions Claude. (SecurityWeek)", "url": "https://bsky.app/profile/sergioiker.bsky.social/post/3n22uhgr3x22h"}, {"timestamp": "2026-11-11T21:09:11.074Z", "date_only": false, "value": "2026-11-11T21:09:11.074266Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3n22uhgr6us2h", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "e72f1600-2e07-4f6a-9d0d-4e6f8ab2fdcb", "content": "4/7 Patch Tuesday: 1,000+ Microsoft fixes, incl. exploited Outlook zero-day CVE-2026-124194 that leaks NTLMv2 hashes (password fingerprints). Finder\u2019s credit mentions Claude. (SecurityWeek)", "url": "https://bsky.app/profile/sergioiker.bsky.social/post/3n22uhgr6us2h"}, {"timestamp": "2026-11-11T21:09:12.038Z", "date_only": false, "value": "2026-11-11T21:09:12.038175Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3n22uhgr7u22h", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "18a1d597-d518-448f-a219-6d9f9b11b16a", "content": "4/7 Patch Tuesday: 1,000+ Microsoft fixes, incl. exploited Outlook zero-day CVE-2026-124194 that leaks NTLMv2 hashes (password fingerprints). Finder\u2019s credit mentions Claude. (SecurityWeek)", "url": "https://bsky.app/profile/sergioiker.bsky.social/post/3n22uhgr7u22h"}, {"timestamp": "2026-11-11T22:20:38.426Z", "date_only": false, "value": "2026-11-11T22:20:38.426694Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/andresec74.bsky.social/post/3n22yhg25g42n", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "9ec77103-53b4-499e-8172-233bdf04f03e", "content": "\ud83d\udea8 CVE-2026-124194: Microsoft Outlook spoofing flaw, actively exploited and now in CISA KEV.\n\nPatch affected Outlook/Microsoft Office systems now.\n\nSource: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-124194\n\n#CyberSecurity #CVE #Microsoft #Outlook", "url": "https://bsky.app/profile/andresec74.bsky.social/post/3n22yhg25g42n"}, {"timestamp": "2026-11-11T23:00:24.582Z", "date_only": false, "value": "2026-11-11T23:00:24.582816Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehotdrop.live/post/3n232ojcbni2e", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "b2a8239e-248e-4d19-9f08-bf13b721c51a", "content": "An exploited Outlook zero-day (CVE-2026-124194) leaks NTLMv2 hashes when a crafted message is opened. It's one of 1,094 fixes this Patch Tuesday.\n\nYouTube: www.youtube.com/shorts/j7LiI...\n\n#Cybersecurity #PatchTuesday #ZeroDay", "url": "https://bsky.app/profile/thehotdrop.live/post/3n232ojcbni2e"}, {"timestamp": "2026-11-12T00:00:00Z", "date_only": false, "value": "2026-11-12T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1511", "record": "CERTFR-2026-AVI-1511", "field": "last_revision_date", "linked_record": true}, {"timestamp": "2026-11-12T00:00:00Z", "date_only": false, "value": "2026-11-12T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1511", "record": "CERTFR-2026-AVI-1511", "field": "initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-12T00:00:00Z", "date_only": false, "value": "2026-11-12T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1511", "record": "CERTFR-2026-AVI-1511", "field": "revisions.0.revision_date", "linked_record": true}, {"timestamp": "2026-11-12T00:23:43.026Z", "date_only": false, "value": "2026-11-12T00:23:43.026351Z", "kind": "sighting", "label": "Seen", "source": "https://mastodon.social/ap/users/115426718704364579/statuses/117600617762234663", "record": "cve-2026-124194", "field": "creation_timestamp", "uuid": "fe389529-2e65-4088-b1bc-7908db28aaac", "content": "\ud83d\udcf0 Microsoft Patches Actively Exploited Outlook Zero-Day in Massive Update\nMicrosoft patches actively exploited Outlook zero-day CVE-2026-124194 in its massive November Patch Tuesday update. The flaw allows attackers to steal NTLM hashes. CISA has added it to the KEV catalog. #PatchTuesday #Outlook #ZeroDay #Cybersecurity\n\ud83d\udd17 https://cyber.netsecops.io/articles/microsoft-patches-outlook-zero-day-cve-2026-124194-in-november-update/?utm_source=mastodon&utm_medium=social&utm_campaign=daily", "url": "https://mastodon.social/ap/users/115426718704364579/statuses/117600617762234663"}, {"timestamp": "2026-11-12T00:24:01.523Z", "date_only": false, "value": "2026-11-12T00:24:01.523070Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3n237dzpdjt23", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "62f059a1-b8ba-429d-9b03-16fe65283285", "content": "Microsoft patches actively exploited Outlook zero-day CVE-2026-124194 in its massive November Patch Tuesday update. The flaw allows attackers to steal NTLM hashes. CISA has added it to the KEV catalog. #PatchTuesday #Outlook #ZeroDay #Cybersecurity\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "url": "https://bsky.app/profile/netsecio.bsky.social/post/3n237dzpdjt23"}, {"timestamp": "2026-11-12T03:00:06Z", "date_only": false, "value": "2026-11-12T03:00:06.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/N0BhlmdoSX-XWsJ5K1RT204X9ik9_hP8MuvDh76uG3TK3Cg", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "2f33887c-6a4c-4e0e-9b5a-0b70622134c2", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-11-12T03:00:06Z", "date_only": false, "value": "2026-11-12T03:00:06.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/N0BhlmdoSX-XWsJ5K1RT204X9ik9_hP8MuvDh76uG3TK3Cg", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "9c608e14-a37a-477e-af4b-5be74dfb26e8"}, {"timestamp": "2026-11-12T04:09:53.637Z", "date_only": false, "value": "2026-11-12T04:09:53.637139Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/techiesjournal.com/post/3n23lxvkc7d24", "record": "cve-2026-124194", "field": "creation_timestamp", "uuid": "080cc467-b693-44a3-831e-8cfa3ebf880e", "content": "Microsoft released November security updates on November 10, 2026.\n\n#Cybersecurity #Microsoft #Outlook #SecurityUpdates #TechiesJournal #PrasadKukkala\n\nhttps://www.techiesjournal.com/microsoft-november-2026-security-updates-outlook-cve-2026-124194/11566/?utm_source=bluesky&utm_medium=social", "url": "https://bsky.app/profile/techiesjournal.com/post/3n23lxvkc7d24"}, {"timestamp": "2026-11-12T07:31:09Z", "date_only": false, "value": "2026-11-12T07:31:09.000000Z", "kind": "sighting", "label": "Seen", "source": "https://cyber.gc.ca/en/alerts-advisories/microsoft-security-advisory-november-2026-monthly-rollup-av26-1142", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "0c8602c3-c0c4-492e-a5d0-38e269f1f42f", "url": "https://cyber.gc.ca/en/alerts-advisories/microsoft-security-advisory-november-2026-monthly-rollup-av26-1142"}, {"timestamp": "2026-11-12T08:16:14.149Z", "date_only": false, "value": "2026-11-12T08:16:14.149502Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/sambishop1406.bsky.social/post/3n23zqbywgs2s", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "d9a2d6fc-fa93-4fca-92e6-92f9605f6f31", "content": "\ud83d\udea8 Microsoft's November Patch Tuesday addresses 1,235 vulnerabilities, including an actively exploited Outlook zero-day.\n\nCVE-2026-124194 has a CVSS score of 6.5. A reminder that a lower severity score doesn't always mean lower risk.\n\nLet's discuss \ud83d\udc47\n\nsambishop1406.substack.com/p/microsofts...", "url": "https://bsky.app/profile/sambishop1406.bsky.social/post/3n23zqbywgs2s"}, {"timestamp": "2026-11-12T08:28:22.231Z", "date_only": false, "value": "2026-11-12T08:28:22.231722Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/niztal.bsky.social/post/3n242g4r2zs2w", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "77403469-badb-4c55-b9b2-4f878aa79932", "content": "Microsoft addressed 1,093 security flaws this month, with 63 rated critical. Microsoft confirmed an Outlook spoofing vulnerability (CVE-2026-124194) is under active exploitation, alongside severe remote code execution bugs in Exchange and SharePoint.", "url": "https://bsky.app/profile/niztal.bsky.social/post/3n242g4r2zs2w"}, {"timestamp": "2026-11-12T08:47:44.832Z", "date_only": false, "value": "2026-11-12T08:47:44.832931Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3n243ir4y3x2p", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "ddbb57f1-bafe-4b24-8757-1dcf39a5d104", "content": "Top 3 CVE for last 7 days:\nCVE-2026-83844: 130 interactions\nCVE-2026-98432: 102 interactions\nCVE-2026-123158: 94 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-124194: 25 interactions\nCVE-2026-125350: 19 interactions\nCVE-2026-20320: 11 interactions\n", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3n243ir4y3x2p"}, {"timestamp": "2026-11-12T09:12:25.049Z", "date_only": false, "value": "2026-11-12T09:12:25.049388Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/eternos974.bsky.social/post/3n244uugejl2r", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "b851eee9-71d4-4f11-a5e6-aad5a05c8ad4", "content": "Outlook est concern\u00e9 par une faille d\u00e9j\u00e0 exploit\u00e9e, la CVE-2026-124194. Microsoft la classe comme mod\u00e9r\u00e9e. Elle figure dans le Patch Tuesday de novembre.\n\nhttps://eternos974.live/index.php/2026/11/12/microsoft-1-235-failles-corrigees-et-une-alerte-outlook/\n\n#PatchTuesday", "url": "https://bsky.app/profile/eternos974.bsky.social/post/3n244uugejl2r"}, {"timestamp": "2026-11-12T10:49:45.198Z", "date_only": false, "value": "2026-11-12T10:49:45.198678Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hey-kira.bsky.social/post/3n24ccwi2b42o", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "190c4816-1466-4f93-87da-99ade61540d4", "content": "Count depends on the source: BleepingComputer lists 1,235 flaws, Tenable's write-up 1,093. Same release, different scoping - worth naming which one you used. What doesn't move: MSRC flags CVE-2026-124194 as Exploitation Detected, so Outlook goes first whatever the 6.5 suggests.", "url": "https://bsky.app/profile/hey-kira.bsky.social/post/3n24ccwi2b42o"}, {"timestamp": "2026-11-12T13:28:25.481Z", "date_only": false, "value": "2026-11-12T13:28:25.481506Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/technology-news.bsky.social/post/3n24l6n6j572d", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "596d93ad-7e14-4d50-b5b9-e2637053b4df", "content": "Microsoft\u2019s October 2026 Patch Tuesday updates fix over 1,000 vulnerabilities, including an exploited Outlook zero-day, CVE-2026-124194.", "url": "https://bsky.app/profile/technology-news.bsky.social/post/3n24l6n6j572d"}, {"timestamp": "2026-11-12T13:42:23.224Z", "date_only": false, "value": "2026-11-12T13:42:23.224051Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3n24lxmlloj2x", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "2e4c133f-7e77-4e3b-a854-8b36ac2ea528", "content": "CISA\u3001\u60aa\u7528\u304c\u78ba\u8a8d\u3055\u308c\u305fMicrosoft Outlook\u306e\u30bc\u30ed\u30c7\u30a4\u8106\u5f31\u6027\u306b\u3064\u3044\u3066\u8b66\u544a\n\n\u7c73\u30b5\u30a4\u30d0\u30fc\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30fb\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5e81\uff08CISA\uff09\u306f\u3001\u60aa\u7528\u304c\u78ba\u8a8d\u3055\u308c\u3066\u3044\u308bMicrosoft Outlook\u306e\u306a\u308a\u3059\u307e\u3057\uff08\u30b9\u30d7\u30fc\u30d5\u30a3\u30f3\u30b0\uff09\u8106\u5f31\u6027\u300cCVE-2026-124194\u300d\u3092\u3001\u300c\u60aa\u7528\u304c\u78ba\u8a8d\u3055\u308c\u305f\u8106\u5f31\u6027\uff08KEV\uff09\u30ab\u30bf\u30ed\u30b0\u300d\u306b\u8ffd\u52a0\u3057\u307e\u3057\u305f\u3002Cloudsecurity solutions \u8ffd\u52a0\u65e5\u306f", "url": "https://bsky.app/profile/blackhatnews.tokyo/post/3n24lxmlloj2x"}, {"timestamp": "2026-11-12T14:01:46.530Z", "date_only": false, "value": "2026-11-12T14:01:46.530786Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hanaguro.bsky.social/post/3n24n2bwhqt2i", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "86421788-bb1b-4f7a-b6e9-2e70383a458a", "content": "[PGX] IPA has called for the urgent application of security updates for Microsoft Outlook following the confirmation of exploit CVE-2026-124194. Opening a specially crafted file can lead to the leak of NTLMv2 hashes, allowing attackers ... https://japan.cnet.com/article/35254771/", "url": "https://bsky.app/profile/hanaguro.bsky.social/post/3n24n2bwhqt2i"}, {"timestamp": "2026-11-12T14:39:34.936Z", "date_only": false, "value": "2026-11-12T14:39:34.936511Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thedailytechfeed.com/post/3n24p5uzxzc2d", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "527abc36-247b-426f-98a1-9de0d2f7edef", "content": "Outlook zero-day CVE-2026-124194 leaks NTLMv2 when users open crafted files\u2014patch immediately. #Outlook #ZeroDay #CVE2026-124194 #Security #PatchNow #CISA https://thedailytechfeed.com/microsoft-outlook-zero-day-actively-exploited-cisa-warns/", "url": "https://bsky.app/profile/thedailytechfeed.com/post/3n24p5uzxzc2d"}, {"timestamp": "2026-11-12T15:01:37.710Z", "date_only": false, "value": "2026-11-12T15:01:37.710532Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3n24qfcjrig25", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "8c78aacc-f8f0-4b10-a958-a0f23e90cb36", "content": "CISA\u3001Microsoft Outlook\u306e\u30bc\u30ed\u30c7\u30a4\u8106\u5f31\u6027\u304c\u60aa\u7528\u3055\u308c\u3066\u3044\u308b\u3053\u3068\u3092\u78ba\u8a8d\n\n\u7c73\u30b5\u30a4\u30d0\u30fc\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30fb\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5e81\uff08CISA\uff09\u306f\u3001Microsoft Outlook\u306e\u306a\u308a\u3059\u307e\u3057\uff08\u30b9\u30d7\u30fc\u30d5\u30a3\u30f3\u30b0\uff09\u306e\u8106\u5f31\u6027\u300cCVE-2026-124194\u300d\u3092\u3001\u60aa\u7528\u304c\u78ba\u8a8d\u3055\u308c\u305f\u8106\u5f31\u6027\u3092\u96c6\u3081\u305f\u300cKnown Exploited Vulnerabilities\uff08KEV\uff09\u30ab\u30bf\u30ed\u30b0\u300d\u306b\u8ffd\u52a0\u3057\u307e\u3057\u305f\u3002 \u3053", "url": "https://bsky.app/profile/blackhatnews.tokyo/post/3n24qfcjrig25"}, {"timestamp": "2026-11-12T15:03:39.198Z", "date_only": false, "value": "2026-11-12T15:03:39.198362Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cloudeteer.bsky.social/post/3n24qiwebrq2l", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "0fb2489f-d357-4a8c-8ff8-043318c38e87", "content": "Outlook-L\u00fccke CVE-2026-124194 wird schon ausgenutzt: Eine ge\u00f6ffnete .msg-Datei schickt NTLM-Anmeldedaten an den Angreifer. Behoben im Office-Sicherheitsupdate vom 10.11. \ud83d\udcec\n\n\ud83d\udcda https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-124194", "url": "https://bsky.app/profile/cloudeteer.bsky.social/post/3n24qiwebrq2l"}, {"timestamp": "2026-11-12T15:14:29.870Z", "date_only": false, "value": "2026-11-12T15:14:29.870797Z", "kind": "sighting", "label": "Seen", "source": "https://mastodon.social/ap/users/115426718704364579/statuses/117604120539969118", "record": "cve-2026-124194", "field": "creation_timestamp", "uuid": "6906aa2a-299a-45f7-ac1c-c30368e47d26", "content": "\ud83d\udcf0 Microsoft Patches Actively Exploited Outlook Zero-Day in Massive Update\nMicrosoft patches actively exploited Outlook zero-day CVE-2026-124194 in its massive November Patch Tuesday update. The flaw allows attackers to steal NTLM hashes. CISA has added it to the KEV catalog. #PatchTuesday #Outlook #ZeroDay #Cybersecurity\n\ud83d\udd17 https://cyber.netsecops.io/articles/microsoft-patches-outlook-zero-day-cve-2026-124194-in-november-update/?utm_source=mastodon&utm_medium=social&utm_campaign=daily", "url": "https://mastodon.social/ap/users/115426718704364579/statuses/117604120539969118"}, {"timestamp": "2026-11-12T15:15:01.138Z", "date_only": false, "value": "2026-11-12T15:15:01.138419Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3n24r5b3l632k", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "ccb41d7a-91d2-497d-9ca5-8c7932cb745a", "content": "Microsoft patches actively exploited Outlook zero-day CVE-2026-124194 in its massive November Patch Tuesday update. The flaw allows attackers to steal NTLM hashes. CISA has added it to the KEV catalog. #PatchTuesday #Outlook #ZeroDay #Cybersecurity\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "url": "https://bsky.app/profile/netsecio.bsky.social/post/3n24r5b3l632k"}, {"timestamp": "2026-11-12T15:33:51.621Z", "date_only": false, "value": "2026-11-12T15:33:51.621000Z", "kind": "sighting", "label": "Exploited", "source": "https://blog.talosintelligence.com/never-be-afraid-to-ask-questions", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "66c6f9ff-7396-4db9-8fa4-d733b2ecacbe", "url": "https://blog.talosintelligence.com/never-be-afraid-to-ask-questions", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-11-12T16:43:22Z", "date_only": false, "value": "2026-11-12T16:43:22.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/cristianbarreiro/b925bed110b3675246e7de841793b119", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "10ca85e6-0781-4f55-ac54-a8228b4d52c1", "content": "# Windows NTLM / SMB Hardening\n## Gu\u00eda defensiva para reducir el riesgo de robo de credenciales asociado a Outlook\n\n**Referencia:** CVE-2026-124194  \n**\u00daltima revisi\u00f3n:** 12 de noviembre de 2026  \n**Plataforma objetivo:** Windows 10 / Windows 11  \n**Formato:** gu\u00eda + script PowerShell con auditor\u00eda, aplicaci\u00f3n y reversi\u00f3n\n\n> **Aviso:** este documento es una gu\u00eda de hardening defensivo. El script no corrige la vulnerabilidad de Outlook, no sustituye las actualizaciones de Microsoft y no garantiza protecci\u00f3n frente a todos los m\u00e9todos de robo de credenciales. Probalo primero en un equipo de prueba y revis\u00e1 las dependencias de red antes de aplicarlo en un equipo de trabajo.\n\n---\n\n## 1. Resumen ejecutivo\n\nCVE-2026-124194 es una vulnerabilidad de suplantaci\u00f3n de Microsoft Outlook. Microsoft public\u00f3 la correcci\u00f3n el **10 de noviembre de 2026** y comunic\u00f3 que hab\u00eda observado explotaci\u00f3n activa. El escenario descrito consiste en convencer a un usuario para que abra un archivo de mensaje especialmente preparado; Outlook puede iniciar una conexi\u00f3n a una ubicaci\u00f3n de red controlada por el atacante sin mostrar la advertencia habitual.\n\nDurante esa conexi\u00f3n, Windows puede exponer material de autenticaci\u00f3n NTLMv2. La respuesta NTLMv2 capturada **no es la contrase\u00f1a en texto claro**; aun as\u00ed, puede ser objeto de ataques de relay o de intentos de cracking sin conexi\u00f3n, dependiendo de las condiciones y de los servicios accesibles.\n\n### Prioridad de remediaci\u00f3n\n\n1. **Instalar la actualizaci\u00f3n de Office/Outlook de noviembre de 2026 o una posterior.**\n2. Bloquear SMB saliente hacia Internet (TCP 445).\n3. Exigir SMB Signing en el cliente y, si corresponde, en el servidor.\n4. Auditar NTLM saliente antes de bloquearlo globalmente.\n5. Considerar el bloqueo de NTLM sobre SMB cuando la versi\u00f3n de Windows lo soporte y despu\u00e9s de probar las dependencias.\n6. Evaluar WebDAV y el servicio `WebClient`; no bloquear indiscriminadamente HTTP/HTTPS.\n\n### Versiones de Office publicadas por Microsoft el 10/11/2026\n\nLos n\u00fameros de compilaci\u00f3n var\u00edan por canal de actualizaci\u00f3n. La siguiente tabla resume las compilaciones publicadas en las notas oficiales de Microsoft:\n\n| Producto / canal | Compilaci\u00f3n publicada |\n|---|---:|\n| Microsoft 365 Apps \u2013 Current Channel | 2610 (20527.20196) |\n| Microsoft 365 Apps \u2013 Monthly Enterprise | 2610 (20527.20194) |\n| Microsoft 365 Apps \u2013 Semi-Annual Enterprise | 2610 (20527.20192) |\n| Office LTSC 2024 | 16.0.17932.21140 |\n| Office LTSC 2021 | 16.0.14334.21048 |\n\nEstas son referencias de las notas de lanzamiento del 10 de noviembre de 2026, no una lista exhaustiva de todos los canales o productos. Comprob\u00e1 la compilaci\u00f3n correspondiente a tu canal en las notas oficiales.\n\nPara comprobar la versi\u00f3n de Outlook cl\u00e1sico:\n**Outlook \u2192 Archivo \u2192 Cuenta de Office \u2192 Acerca de Outlook**.\n\n---\n\n## 2. C\u00f3mo funciona el riesgo\n\n### Flujo simplificado\n\n1. Un atacante env\u00eda un archivo de mensaje de Outlook manipulado.\n2. La v\u00edctima abre el archivo en una versi\u00f3n vulnerable de Outlook.\n3. Outlook intenta acceder a una ubicaci\u00f3n de red externa.\n4. Windows puede intentar autenticarse mediante NTLM.\n5. El servidor remoto puede capturar la respuesta NTLMv2 y tratar de utilizarla en ataques posteriores.\n\n### Conceptos importantes\n\n- **NTLM:** familia de protocolos de autenticaci\u00f3n heredados de Windows.\n- **NTLMv2:** variante m\u00e1s robusta que NTLMv1, pero que sigue expuesta a ciertos ataques de relay y cracking de respuestas capturadas.\n- **SMB:** protocolo utilizado para compartir archivos, carpetas e impresoras.\n- **TCP 445:** puerto habitual de SMB sobre TCP.\n- **SMB Signing:** firma de mensajes SMB para proteger su integridad y dificultar ataques de relay.\n- **SMB NTLM blocking:** funci\u00f3n de Windows que impide que el cliente SMB utilice NTLM para autenticarse contra servidores remotos compatibles con esta pol\u00edtica.\n- **WebDAV:** mecanismo para acceder a recursos de archivos mediante HTTP/HTTPS. Deshabilitar el servicio WebClient puede afectar su uso, pero no equivale a bloquear todo el tr\u00e1fico WebDAV de todas las aplicaciones.\n\n### Qu\u00e9 significa cada control\n\n| Control | Qu\u00e9 aporta | Qu\u00e9 no hace |\n|---|---|---|\n| Bloqueo de TCP 445 saliente a Internet | Reduce la posibilidad de enviar autenticaci\u00f3n SMB a servidores externos | No bloquea WebDAV ni corrige Outlook |\n| SMB Signing obligatorio | Protege la integridad de las sesiones SMB y dificulta relay | No evita que se capture una respuesta NTLM por s\u00ed solo |\n| Bloqueo NTLM sobre SMB | Evita NTLM en el cliente SMB cuando la funci\u00f3n est\u00e1 disponible | No bloquea NTLM usado por cualquier otra aplicaci\u00f3n |\n| Auditor\u00eda NTLM saliente | Identifica aplicaciones y servidores que todav\u00eda dependen de NTLM | No bloquea el tr\u00e1fico |\n| Deshabilitar WebClient | Reduce el uso del cliente WebDAV de Windows | No bloquea todo HTTP/HTTPS ni todos los clientes WebDAV |\n| Actualizar Office | Corrige el fallo de Outlook seg\u00fan la actualizaci\u00f3n del proveedor | No sustituye el hardening general de Windows |\n\n---\n\n## 3. Alcance y decisiones de seguridad del script\n\nEl script incluido implementa tres modos:\n\n- `Audit`: consulta el estado actual sin cambiar la configuraci\u00f3n.\n- `Apply`: guarda una l\u00ednea base y aplica los controles seleccionados.\n- `Restore`: elimina las reglas que cre\u00f3 el script y restaura las configuraciones guardadas.\n\n### Qu\u00e9 aplica por defecto en modo `Apply`\n\n- Crea reglas de firewall salientes para bloquear TCP 445, TCP 139, UDP 137 y UDP 138 hacia el \u00e1mbito de direcciones `Internet`.\n- Exige SMB Signing en el cliente SMB.\n- Configura la pol\u00edtica de NTLM saliente en modo **Audit all** (`RestrictSendingNTLMTraffic = 1`).\n- Habilita el registro operacional NTLM cuando el canal est\u00e1 disponible.\n- Guarda una l\u00ednea base en `%ProgramData%\\WindowsNTLMHardening`.\n\n### Controles opcionales\n\n| Par\u00e1metro | Acci\u00f3n | Riesgo de compatibilidad |\n|---|---|---|\n| `-BlockSmbNtlm` | Activa `Set-SmbClientConfiguration -BlockNTLM $true` si Windows ofrece ese par\u00e1metro | Puede impedir conexiones a NAS o servidores SMB antiguos que dependen de NTLM |\n| `-RequireSmbServerSigning` | Exige firma SMB tambi\u00e9n para conexiones entrantes al servidor SMB local | Puede afectar clientes SMB antiguos |\n| `-DisableWebClient` | Detiene y deshabilita el servicio WebClient | Las unidades y recursos WebDAV pueden dejar de funcionar |\n\n**El script no bloquea TCP 80 ni TCP 443.** Esos puertos transportan la navegaci\u00f3n web normal. Filtrar WebDAV por m\u00e9todo HTTP requiere un proxy o una soluci\u00f3n de inspecci\u00f3n de tr\u00e1fico; una regla de firewall basada solamente en los puertos 80/443 ser\u00eda demasiado amplia.\n\n**El script tampoco configura EPA, Protected Users ni pol\u00edticas de dominio.** Esas medidas requieren una evaluaci\u00f3n del entorno y, en muchos casos, administraci\u00f3n de Active Directory.\n\n---\n\n## 4. Script PowerShell completo\n\nGuard\u00e1 el siguiente contenido como:\n\n`Windows-NTLM-SMB-Hardening.ps1`\n\nRequisitos:\n- Windows 10 o Windows 11 actualizado.\n- Windows PowerShell 5.1 o PowerShell 7 con los m\u00f3dulos/cmdlets de Windows disponibles.\n- Ejecutar como administrador.\n- Revisar primero el modo `Audit`.\n- Si el equipo pertenece a un dominio, comprobar las GPO: una directiva de dominio puede prevalecer sobre la configuraci\u00f3n local.\n\n```powershell\n#requires -Version 5.1\n#requires -RunAsAdministrator\n\n<#\n.SYNOPSIS\n    Hardening defensivo de Windows frente a exposici\u00f3n de autenticaci\u00f3n NTLM.\n\n.DESCRIPTION\n    Modos:\n      Audit   : consulta la configuraci\u00f3n sin modificarla.\n      Apply   : guarda una l\u00ednea base y aplica las protecciones seleccionadas.\n      Restore : restaura la l\u00ednea base y elimina las reglas creadas por este script.\n\n    Protecciones:\n      - Bloqueo de SMB/NetBIOS saliente hacia Internet.\n      - SMB Signing obligatorio en el cliente.\n      - Auditor\u00eda de NTLM saliente.\n      - Registro operacional NTLM.\n      - Bloqueo NTLM sobre SMB (opcional y dependiente de versi\u00f3n).\n      - SMB Server Signing (opcional).\n      - Deshabilitar WebClient (opcional).\n\n.NOTES\n    Ejecutar en una consola elevada.\n    Probar en un entorno controlado antes de usar en producci\u00f3n.\n#>\n\n[CmdletBinding()]\nparam(\n    [ValidateSet('Audit', 'Apply', 'Restore')]\n    [string]$Mode = 'Audit',\n\n    [switch]$BlockSmbNtlm,\n\n    [switch]$RequireSmbServerSigning,\n\n    [switch]$DisableWebClient,\n\n    [string]$BackupPath\n)\n\n$ErrorActionPreference = 'Stop'\n\n$RegistryPath = 'HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\MSV1_0'\n$NtlmRegistryValue = 'RestrictSendingNTLMTraffic'\n$NtlmEventChannel = 'Microsoft-Windows-NTLM/Operational'\n$BackupRoot = Join-Path $env:ProgramData 'WindowsNTLMHardening'\n\n$FirewallRules = @(\n    [pscustomobject]@{\n        Name        = 'CB-OutlookNTLM-SMB-TCP445'\n        DisplayName = 'Hardening - Block Internet SMB TCP 445'\n        Protocol    = 'TCP'\n        RemotePort  = '445'\n    },\n    [pscustomobject]@{\n        Name        = 'CB-OutlookNTLM-NetBIOS-TCP139'\n        DisplayName = 'Hardening - Block Internet NetBIOS TCP 139'\n        Protocol    = 'TCP'\n        RemotePort  = '139'\n    },\n    [pscustomobject]@{\n        Name        = 'CB-OutlookNTLM-NetBIOS-UDP137'\n        DisplayName = 'Hardening - Block Internet NetBIOS UDP 137'\n        Protocol    = 'UDP'\n        RemotePort  = '137'\n    },\n    [pscustomobject]@{\n        Name        = 'CB-OutlookNTLM-NetBIOS-UDP138'\n        DisplayName = 'Hardening - Block Internet NetBIOS UDP 138'\n        Protocol    = 'UDP'\n        RemotePort  = '138'\n    }\n)\n\nfunction Write-Section {\n    param([string]$Title)\n\n    Write-Host ''\n    Write-Host ('=' * 64) -ForegroundColor DarkCyan\n    Write-Host \" $Title\" -ForegroundColor Cyan\n    Write-Host ('=' * 64) -ForegroundColor DarkCyan\n}\n\nfunction Get-OptionalRegistryValue {\n    param(\n        [string]$Path,\n        [string]$Name\n    )\n\n    try {\n        $value = Get-ItemPropertyValue -Path $Path -Name $Name -ErrorAction Stop\n\n        return [pscustomobject]@{\n            Exists = $true\n            Value  = [int]$value\n        }\n    }\n    catch {\n        return [pscustomobject]@{\n            Exists = $false\n            Value  = $null\n        }\n    }\n}\n\nfunction Get-CurrentBaseline {\n    $client = $null\n    $server = $null\n    $webClient = $null\n    $ntlmLogEnabled = $null\n\n    try {\n        $client = Get-SmbClientConfiguration -ErrorAction Stop\n    }\n    catch {\n        Write-Warning \"No se pudo consultar la configuraci\u00f3n del cliente SMB.\"\n    }\n\n    try {\n        $server = Get-SmbServerConfiguration -ErrorAction Stop\n    }\n    catch {\n        Write-Warning \"No se pudo consultar la configuraci\u00f3n del servidor SMB.\"\n    }\n\n    try {\n        $webClient = Get-CimInstance -ClassName Win32_Service `\n            -Filter \"Name='WebClient'\" -ErrorAction Stop\n    }\n    catch {\n        $webClient = $null\n    }\n\n    try {\n        $ntlmLogEnabled = [bool](\n            Get-WinEvent -ListLog $NtlmEventChannel -ErrorAction Stop\n        ).IsEnabled\n    }\n    catch {\n        $ntlmLogEnabled = $null\n    }\n\n    $ntlmValue = Get-OptionalRegistryValue `\n        -Path $RegistryPath `\n        -Name $NtlmRegistryValue\n\n    $blockNtlmProperty = $null\n\n    if ($null -ne $client) {\n        $blockNtlmProperty = $client.PSObject.Properties['BlockNTLM']\n    }\n\n    $blockNtlmSupported = ($null -ne $blockNtlmProperty)\n\n    $clientBaseline = [ordered]@{\n        Available = ($null -ne $client)\n\n        RequireSecuritySignature = if ($client) {\n            [bool]$client.RequireSecuritySignature\n        } else {\n            $null\n        }\n\n        EnableSecuritySignature = if ($client) {\n            [bool]$client.EnableSecuritySignature\n        } else {\n            $null\n        }\n\n        BlockNTLMSupported = $blockNtlmSupported\n\n        BlockNTLM = if ($blockNtlmSupported) {\n            [bool]$blockNtlmProperty.Value\n        } else {\n            $null\n        }\n    }\n\n    $serverBaseline = [ordered]@{\n        Available = ($null -ne $server)\n\n        RequireSecuritySignature = if ($server) {\n            [bool]$server.RequireSecuritySignature\n        } else {\n            $null\n        }\n\n        EnableSecuritySignature = if ($server) {\n            [bool]$server.EnableSecuritySignature\n        } else {\n            $null\n        }\n    }\n\n    $webClientBaseline = $null\n\n    if ($webClient) {\n        $webClientBaseline = [ordered]@{\n            StartMode = [string]$webClient.StartMode\n            State     = [string]$webClient.State\n        }\n    }\n\n    return [ordered]@{\n        CreatedAt = (Get-Date).ToString('o')\n\n        SmbClient = $clientBaseline\n\n        SmbServer = $serverBaseline\n\n        NtlmOutgoing = [ordered]@{\n            Exists = [bool]$ntlmValue.Exists\n            Value  = $ntlmValue.Value\n        }\n\n        NtlmOperationalLogEnabled = $ntlmLogEnabled\n\n        WebClient = $webClientBaseline\n    }\n}\n\nfunction Show-Audit {\n    Write-Section 'AUDITOR\u00cdA DE SEGURIDAD'\n\n    Write-Host 'Firewall profiles:' -ForegroundColor Yellow\n\n    try {\n        Get-NetFirewallProfile |\n            Select-Object Name, Enabled, DefaultOutboundAction |\n            Format-Table -AutoSize\n    }\n    catch {\n        Write-Warning \"No se pudo consultar Windows Defender Firewall.\"\n    }\n\n    Write-Host 'Reglas de hardening:' -ForegroundColor Yellow\n\n    foreach ($rule in $FirewallRules) {\n        $found = Get-NetFirewallRule -Name $rule.Name `\n            -ErrorAction SilentlyContinue\n\n        if ($found) {\n            $found |\n                Select-Object DisplayName, Enabled, Direction, Action |\n                Format-Table -AutoSize\n        }\n        else {\n            Write-Host \"No creada: $($rule.Name)\" -ForegroundColor DarkGray\n        }\n    }\n\n    Write-Host 'SMB Client:' -ForegroundColor Yellow\n\n    try {\n        Get-SmbClientConfiguration |\n            Select-Object RequireSecuritySignature,\n                          EnableSecuritySignature,\n                          BlockNTLM |\n            Format-List\n    }\n    catch {\n        Write-Warning \"No se pudo consultar SMB Client.\"\n    }\n\n    Write-Host 'SMB Server:' -ForegroundColor Yellow\n\n    try {\n        Get-SmbServerConfiguration |\n            Select-Object RequireSecuritySignature,\n                          EnableSecuritySignature |\n            Format-List\n    }\n    catch {\n        Write-Warning \"No se pudo consultar SMB Server.\"\n    }\n\n    Write-Host 'NTLM outgoing policy:' -ForegroundColor Yellow\n\n    $ntlmValue = Get-OptionalRegistryValue `\n        -Path $RegistryPath `\n        -Name $NtlmRegistryValue\n\n    if ($ntlmValue.Exists) {\n        $policyName = switch ($ntlmValue.Value) {\n            0 { 'Allow all' }\n            1 { 'Audit all' }\n            2 { 'Deny all' }\n            default { 'Valor desconocido' }\n        }\n\n        Write-Host \"RestrictSendingNTLMTraffic = $($ntlmValue.Value) ($policyName)\"\n    }\n    else {\n        Write-Host 'RestrictSendingNTLMTraffic no est\u00e1 definido localmente.'\n    }\n\n    Write-Host 'WebClient:' -ForegroundColor Yellow\n\n    try {\n        Get-CimInstance -ClassName Win32_Service `\n            -Filter \"Name='WebClient'\" -ErrorAction Stop |\n            Select-Object Name, State, StartMode |\n            Format-Table -AutoSize\n    }\n    catch {\n        Write-Host 'El servicio WebClient no est\u00e1 disponible.' -ForegroundColor DarkGray\n    }\n\n    Write-Host 'Eventos NTLM recientes (\u00faltimos 7 d\u00edas):' -ForegroundColor Yellow\n\n    try {\n        Get-WinEvent -FilterHashtable @{\n            LogName   = $NtlmEventChannel\n            Id        = @(8001, 4020, 4021)\n            StartTime = (Get-Date).AddDays(-7)\n        } -MaxEvents 30 -ErrorAction Stop |\n            Select-Object TimeCreated, Id, LevelDisplayName, Message |\n            Format-List\n    }\n    catch {\n        Write-Host 'No hay eventos disponibles o el canal no est\u00e1 habilitado.' `\n            -ForegroundColor DarkGray\n    }\n\n    Write-Host ''\n    Write-Host 'La auditor\u00eda no realiza cambios.' -ForegroundColor Green\n}\n\nfunction Save-Baseline {\n    $baseline = Get-CurrentBaseline\n\n    New-Item -ItemType Directory -Path $BackupRoot -Force |\n        Out-Null\n\n    $timestamp = Get-Date -Format 'yyyyMMdd-HHmmss'\n    $destination = Join-Path $BackupRoot $timestamp\n\n    New-Item -ItemType Directory -Path $destination -Force |\n        Out-Null\n\n    $baselineFile = Join-Path $destination 'baseline.json'\n\n    $baseline |\n        ConvertTo-Json -Depth 8 |\n        Set-Content -Path $baselineFile -Encoding UTF8\n\n    Write-Host \"L\u00ednea base guardada en: $destination\" -ForegroundColor Green\n\n    return $destination\n}\n\nfunction Set-NtlmAuditMode {\n    if (-not (Test-Path $RegistryPath)) {\n        New-Item -Path $RegistryPath -Force | Out-Null\n    }\n\n    # 0 = Allow all\n    # 1 = Audit all\n    # 2 = Deny all\n    #\n    # Se usa 1 para identificar dependencias antes de bloquear NTLM.\n\n    New-ItemProperty `\n        -Path $RegistryPath `\n        -Name $NtlmRegistryValue `\n        -PropertyType DWord `\n        -Value 1 `\n        -Force |\n        Out-Null\n\n    Write-Host '[OK] NTLM saliente configurado en modo auditor\u00eda.' `\n        -ForegroundColor Green\n}\n\nfunction Enable-NtlmOperationalLog {\n    try {\n        & wevtutil.exe sl $NtlmEventChannel /e:true\n\n        if ($LASTEXITCODE -eq 0) {\n            Write-Host '[OK] Registro operacional NTLM habilitado.' `\n                -ForegroundColor Green\n        }\n        else {\n            Write-Warning 'wevtutil no pudo habilitar el canal NTLM.'\n        }\n    }\n    catch {\n        Write-Warning \"No se pudo habilitar el canal NTLM: $_\"\n    }\n}\n\nfunction Apply-Hardening {\n    Write-Section 'APLICACI\u00d3N DE HARDENING'\n\n    # Evita sobrescribir o eliminar reglas preexistentes con estos nombres.\n    $existingRuleNames = @()\n\n    foreach ($rule in $FirewallRules) {\n        if (Get-NetFirewallRule -Name $rule.Name -ErrorAction SilentlyContinue) {\n            $existingRuleNames += $rule.Name\n        }\n    }\n\n    if ($existingRuleNames.Count -gt 0) {\n        throw (\n            'Ya existen reglas con nombres reservados por este script: ' +\n            ($existingRuleNames -join ', ') +\n            '. No se aplicaron cambios. Inspeccionalas antes de continuar.'\n        )\n    }\n\n    $backupDirectory = Save-Baseline\n\n    Write-Host ''\n    Write-Host '[1/6] Firewall saliente' -ForegroundColor Yellow\n\n    foreach ($rule in $FirewallRules) {\n        try {\n            New-NetFirewallRule `\n                -Name $rule.Name `\n                -DisplayName $rule.DisplayName `\n                -Group 'Windows NTLM SMB Hardening' `\n                -Direction Outbound `\n                -Action Block `\n                -Enabled True `\n                -Profile Any `\n                -Protocol $rule.Protocol `\n                -RemotePort $rule.RemotePort `\n                -RemoteAddress 'Internet' `\n                -Description 'Bloquea SMB/NetBIOS saliente hacia direcciones Internet.' |\n                Out-Null\n\n            Write-Host \"[OK] $($rule.DisplayName)\" -ForegroundColor Green\n        }\n        catch {\n            Write-Warning \"No se pudo crear $($rule.Name): $_\"\n        }\n    }\n\n    Write-Host ''\n    Write-Host '[2/6] SMB Client Signing' -ForegroundColor Yellow\n\n    try {\n        Set-SmbClientConfiguration `\n            -EnableSecuritySignature $true `\n            -RequireSecuritySignature $true `\n            -Confirm:$false\n\n        Write-Host '[OK] SMB Client Signing requerido.' -ForegroundColor Green\n    }\n    catch {\n        Write-Warning \"No se pudo configurar SMB Client Signing: $_\"\n    }\n\n    Write-Host ''\n    Write-Host '[3/6] SMB Server Signing opcional' -ForegroundColor Yellow\n\n    if ($RequireSmbServerSigning) {\n        try {\n            Set-SmbServerConfiguration `\n                -EnableSecuritySignature $true `\n                -RequireSecuritySignature $true `\n                -Confirm:$false\n\n            Write-Host '[OK] SMB Server Signing requerido.' -ForegroundColor Green\n        }\n        catch {\n            Write-Warning \"No se pudo configurar SMB Server Signing: $_\"\n        }\n    }\n    else {\n        Write-Host 'Sin cambios. Us\u00e1 -RequireSmbServerSigning para activarlo.' `\n            -ForegroundColor DarkGray\n    }\n\n    Write-Host ''\n    Write-Host '[4/6] NTLM saliente en modo auditor\u00eda' -ForegroundColor Yellow\n\n    try {\n        Set-NtlmAuditMode\n        Enable-NtlmOperationalLog\n    }\n    catch {\n        Write-Warning \"No se pudo configurar auditor\u00eda NTLM: $_\"\n    }\n\n    Write-Host ''\n    Write-Host '[5/6] Bloqueo NTLM sobre SMB opcional' -ForegroundColor Yellow\n\n    if ($BlockSmbNtlm) {\n        try {\n            $command = Get-Command Set-SmbClientConfiguration `\n                -ErrorAction Stop\n\n            if ($command.Parameters.ContainsKey('BlockNTLM')) {\n                Set-SmbClientConfiguration `\n                    -BlockNTLM $true `\n                    -Confirm:$false\n\n                Write-Host '[OK] NTLM bloqueado en el cliente SMB.' `\n                    -ForegroundColor Green\n            }\n            else {\n                Write-Warning 'Esta versi\u00f3n de Windows no ofrece -BlockNTLM.'\n            }\n        }\n        catch {\n            Write-Warning \"No se pudo activar el bloqueo NTLM en SMB: $_\"\n        }\n    }\n    else {\n        Write-Host 'Sin cambios. Us\u00e1 -BlockSmbNtlm despu\u00e9s de probar compatibilidad.' `\n            -ForegroundColor DarkGray\n    }\n\n    Write-Host ''\n    Write-Host '[6/6] WebClient / WebDAV opcional' -ForegroundColor Yellow\n\n    if ($DisableWebClient) {\n        try {\n            $service = Get-Service -Name WebClient -ErrorAction Stop\n\n            if ($service.Status -eq 'Running') {\n                Stop-Service -Name WebClient -Force -ErrorAction Stop\n            }\n\n            Set-Service -Name WebClient -StartupType Disabled\n\n            Write-Host '[OK] Servicio WebClient deshabilitado.' `\n                -ForegroundColor Green\n        }\n        catch {\n            Write-Warning \"No se pudo deshabilitar WebClient: $_\"\n        }\n    }\n    else {\n        Write-Host 'WebClient no fue modificado.' -ForegroundColor DarkGray\n    }\n\n    Write-Host ''\n    Write-Host 'Aplicaci\u00f3n finalizada.' -ForegroundColor Green\n    Write-Host \"Backup: $backupDirectory\" -ForegroundColor Cyan\n    Write-Host 'Ejecut\u00e1 el modo Audit para comprobar los resultados.'\n}\n\nfunction Restore-Baseline {\n    Write-Section 'RESTAURACI\u00d3N DE CONFIGURACI\u00d3N'\n\n    if ([string]::IsNullOrWhiteSpace($BackupPath)) {\n        if (-not (Test-Path $BackupRoot)) {\n            throw \"No existe el directorio de backups: $BackupRoot\"\n        }\n\n        $latest = Get-ChildItem -Path $BackupRoot -Directory |\n            Where-Object {\n                Test-Path (Join-Path $_.FullName 'baseline.json')\n            } |\n            Sort-Object LastWriteTime -Descending |\n            Select-Object -First 1\n\n        if (-not $latest) {\n            throw 'No se encontr\u00f3 ninguna l\u00ednea base.'\n        }\n\n        $BackupPath = $latest.FullName\n    }\n\n    $baselineFile = Join-Path $BackupPath 'baseline.json'\n\n    if (-not (Test-Path $baselineFile)) {\n        throw \"No se encontr\u00f3 baseline.json en: $BackupPath\"\n    }\n\n    $baseline = Get-Content -Path $baselineFile -Raw |\n        ConvertFrom-Json\n\n    Write-Host \"Restaurando desde: $BackupPath\" -ForegroundColor Cyan\n\n    # Eliminar \u00fanicamente las reglas creadas por este script.\n    foreach ($rule in $FirewallRules) {\n        Get-NetFirewallRule -Name $rule.Name -ErrorAction SilentlyContinue |\n            Remove-NetFirewallRule -ErrorAction SilentlyContinue\n    }\n\n    Write-Host '[OK] Reglas de firewall del script eliminadas.' `\n        -ForegroundColor Green\n\n    # Restaurar SMB Client.\n    if ($baseline.SmbClient.Available) {\n        try {\n            $parameters = @{}\n\n            if ($null -ne $baseline.SmbClient.RequireSecuritySignature) {\n                $parameters.RequireSecuritySignature =\n                    [bool]$baseline.SmbClient.RequireSecuritySignature\n            }\n\n            if ($null -ne $baseline.SmbClient.EnableSecuritySignature) {\n                $parameters.EnableSecuritySignature =\n                    [bool]$baseline.SmbClient.EnableSecuritySignature\n            }\n\n            $command = Get-Command Set-SmbClientConfiguration `\n                -ErrorAction SilentlyContinue\n\n            if (\n                $baseline.SmbClient.BlockNTLMSupported -and\n                $command -and\n                $command.Parameters.ContainsKey('BlockNTLM')\n            ) {\n                $parameters.BlockNTLM =\n                    [bool]$baseline.SmbClient.BlockNTLM\n            }\n\n            if ($parameters.Count -gt 0) {\n                Set-SmbClientConfiguration @parameters -Confirm:$false\n            }\n\n            Write-Host '[OK] SMB Client restaurado.' -ForegroundColor Green\n        }\n        catch {\n            Write-Warning \"No se pudo restaurar SMB Client: $_\"\n        }\n    }\n\n    # Restaurar SMB Server.\n    if ($baseline.SmbServer.Available) {\n        try {\n            $parameters = @{}\n\n            if ($null -ne $baseline.SmbServer.RequireSecuritySignature) {\n                $parameters.RequireSecuritySignature =\n                    [bool]$baseline.SmbServer.RequireSecuritySignature\n            }\n\n            if ($null -ne $baseline.SmbServer.EnableSecuritySignature) {\n                $parameters.EnableSecuritySignature =\n                    [bool]$baseline.SmbServer.EnableSecuritySignature\n            }\n\n            if ($parameters.Count -gt 0) {\n                Set-SmbServerConfiguration @parameters -Confirm:$false\n            }\n\n            Write-Host '[OK] SMB Server restaurado.' -ForegroundColor Green\n        }\n        catch {\n            Write-Warning \"No se pudo restaurar SMB Server: $_\"\n        }\n    }\n\n    # Restaurar el valor de pol\u00edtica NTLM saliente.\n    try {\n        if ($baseline.NtlmOutgoing.Exists) {\n            if (-not (Test-Path $RegistryPath)) {\n                New-Item -Path $RegistryPath -Force | Out-Null\n            }\n\n            New-ItemProperty `\n                -Path $RegistryPath `\n                -Name $NtlmRegistryValue `\n                -PropertyType DWord `\n                -Value ([int]$baseline.NtlmOutgoing.Value) `\n                -Force |\n                Out-Null\n        }\n        else {\n            Remove-ItemProperty `\n                -Path $RegistryPath `\n                -Name $NtlmRegistryValue `\n                -ErrorAction SilentlyContinue\n        }\n\n        Write-Host '[OK] Pol\u00edtica NTLM saliente restaurada.' `\n            -ForegroundColor Green\n    }\n    catch {\n        Write-Warning \"No se pudo restaurar la pol\u00edtica NTLM: $_\"\n    }\n\n    # Restaurar estado del canal operacional NTLM.\n    if ($null -ne $baseline.NtlmOperationalLogEnabled) {\n        try {\n            $enabled = if ($baseline.NtlmOperationalLogEnabled) {\n                'true'\n            }\n            else {\n                'false'\n            }\n\n            & wevtutil.exe sl $NtlmEventChannel \"/e:$enabled\"\n        }\n        catch {\n            Write-Warning 'No se pudo restaurar el estado del canal NTLM.'\n        }\n    }\n\n    # Restaurar WebClient si estaba disponible en la l\u00ednea base.\n    if ($null -ne $baseline.WebClient) {\n        try {\n            $startupType = switch ($baseline.WebClient.StartMode) {\n                'Auto'     { 'Automatic' }\n                'Manual'   { 'Manual' }\n                'Disabled' { 'Disabled' }\n                default    { $null }\n            }\n\n            if ($startupType) {\n                Set-Service -Name WebClient -StartupType $startupType\n            }\n\n            if ($baseline.WebClient.State -eq 'Running') {\n                Start-Service -Name WebClient -ErrorAction SilentlyContinue\n            }\n            else {\n                Stop-Service -Name WebClient -Force -ErrorAction SilentlyContinue\n            }\n\n            Write-Host '[OK] WebClient restaurado.' -ForegroundColor Green\n        }\n        catch {\n            Write-Warning \"No se pudo restaurar WebClient: $_\"\n        }\n    }\n\n    Write-Host ''\n    Write-Host 'Restauraci\u00f3n finalizada. Ejecut\u00e1 -Mode Audit para verificar.' `\n        -ForegroundColor Green\n}\n\n# ---------------------------------------------------------------------\n# MAIN\n# ---------------------------------------------------------------------\n\nWrite-Host ''\nWrite-Host 'WINDOWS NTLM / SMB HARDENING' -ForegroundColor Cyan\nWrite-Host \"Mode: $Mode\" -ForegroundColor Cyan\n\nswitch ($Mode) {\n    'Audit' {\n        Show-Audit\n    }\n\n    'Apply' {\n        Apply-Hardening\n    }\n\n    'Restore' {\n        Restore-Baseline\n    }\n}\n```\n\n---\n\n## 5. C\u00f3mo ejecutarlo\n\n### Paso 1 \u2014 Guardar el archivo\n\nGuard\u00e1 el c\u00f3digo como `Windows-NTLM-SMB-Hardening.ps1`.\n\nAbr\u00ed PowerShell como administrador y naveg\u00e1 a la carpeta donde lo guardaste.\n\n### Paso 2 \u2014 Auditar antes de modificar\n\n```powershell\n.\\Windows-NTLM-SMB-Hardening.ps1 -Mode Audit\n```\n\nRevis\u00e1:\n- Si Windows Defender Firewall est\u00e1 habilitado.\n- Si ya existe SMB Signing.\n- Si hay una pol\u00edtica NTLM configurada.\n- Si hay autenticaciones NTLM salientes.\n- Si WebClient est\u00e1 instalado y en ejecuci\u00f3n.\n\n### Paso 3 \u2014 Aplicar el hardening b\u00e1sico\n\n```powershell\n.\\Windows-NTLM-SMB-Hardening.ps1 -Mode Apply\n```\n\nEsta modalidad crea el backup, bloquea SMB/NetBIOS saliente hacia Internet, exige SMB Signing en el cliente y activa auditor\u00eda NTLM.\n\n### Paso 4 \u2014 Elegir controles adicionales (opcional)\n\nAntes de aplicar, revis\u00e1 la compatibilidad con NAS, servidores de archivos y recursos WebDAV. Si decid\u00eds activar los controles opcionales, ejecut\u00e1 **una sola vez** el modo `Apply` con todos los par\u00e1metros deseados:\n\n```powershell\n.\\Windows-NTLM-SMB-Hardening.ps1 `\n    -Mode Apply `\n    -BlockSmbNtlm `\n    -RequireSmbServerSigning `\n    -DisableWebClient\n```\n\nNo ejecutes `-Mode Apply` una segunda vez encima de una aplicaci\u00f3n previa: el script detecta sus reglas existentes y aborta para evitar sobrescribirlas o crear una l\u00ednea base confusa.\n\nSi ya aplicaste el modo b\u00e1sico y quer\u00e9s cambiar las opciones, primero restaur\u00e1 la l\u00ednea base que gener\u00f3 esa aplicaci\u00f3n; despu\u00e9s ejecut\u00e1 una \u00fanica aplicaci\u00f3n con la combinaci\u00f3n de par\u00e1metros elegida.\n\n### Paso 5 \u2014 Verificar\n\n```powershell\n.\\Windows-NTLM-SMB-Hardening.ps1 -Mode Audit\n```\n\n---\n\n## 6. Verificaci\u00f3n manual\n\n### 6.1 Comprobar SMB Signing\n\n```powershell\nGet-SmbClientConfiguration |\n    Select-Object RequireSecuritySignature, EnableSecuritySignature\n\nGet-SmbServerConfiguration |\n    Select-Object RequireSecuritySignature, EnableSecuritySignature\n```\n\nPara los componentes configurados como obligatorios, `RequireSecuritySignature` deber\u00eda ser `True`.\n\n### 6.2 Comprobar bloqueo NTLM sobre SMB\n\n```powershell\nGet-SmbClientConfiguration |\n    Select-Object BlockNTLM\n```\n\nSi la propiedad no aparece, esa versi\u00f3n de Windows no expone esta funci\u00f3n mediante el cmdlet.\n\n### 6.3 Comprobar reglas de firewall\n\n```powershell\nGet-NetFirewallRule -Name 'CB-OutlookNTLM-*' |\n    Select-Object DisplayName, Enabled, Direction, Action\n```\n\nEl resultado esperado es:\n- `Enabled`: `True`\n- `Direction`: `Outbound`\n- `Action`: `Block`\n\nComprob\u00e1 tambi\u00e9n que Windows Defender Firewall est\u00e9 habilitado para el perfil de red activo.\n\n### 6.4 Comprobar pol\u00edtica NTLM saliente\n\n```powershell\nGet-ItemProperty `\n    -Path 'HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\MSV1_0' `\n    -Name RestrictSendingNTLMTraffic\n```\n\nValores:\n- `0`: permitir todo.\n- `1`: auditar todo.\n- `2`: denegar todo.\n\nEl script aplica `1`, no `2`.\n\n### 6.5 Consultar eventos NTLM\n\n```powershell\n$ids = 8001, 4020, 4021\n\nGet-WinEvent -FilterHashtable @{\n    LogName   = 'Microsoft-Windows-NTLM/Operational'\n    Id        = $ids\n    StartTime = (Get-Date).AddDays(-7)\n} -MaxEvents 50 |\n    Select-Object TimeCreated, Id, LevelDisplayName, Message |\n    Format-List\n```\n\nLos eventos exactos dependen de la versi\u00f3n de Windows y de las pol\u00edticas de auditor\u00eda:\n- `8001` puede aparecer en auditor\u00eda de NTLM saliente tradicional.\n- `4020` y `4021` son eventos de auditor\u00eda mejorada de NTLM en versiones compatibles.\n\nRevis\u00e1 el proceso, el destino, la cuenta y la direcci\u00f3n IP. Una autenticaci\u00f3n NTLM no es autom\u00e1ticamente maliciosa: investig\u00e1 especialmente destinos externos o inesperados.\n\n---\n\n## 7. C\u00f3mo revertir los cambios\n\nEl script guarda sus l\u00edneas base en:\n\n```text\nC:\\ProgramData\\WindowsNTLMHardening\\\n```\n\nPara restaurar la l\u00ednea base m\u00e1s reciente:\n\n```powershell\n.\\Windows-NTLM-SMB-Hardening.ps1 -Mode Restore\n```\n\nPara restaurar una l\u00ednea base espec\u00edfica:\n\n```powershell\n.\\Windows-NTLM-SMB-Hardening.ps1 `\n    -Mode Restore `\n    -BackupPath 'C:\\ProgramData\\WindowsNTLMHardening\\20261112-120000'\n```\n\nLa restauraci\u00f3n:\n- Elimina \u00fanicamente las reglas de firewall con los nombres definidos por este script.\n- Restaura los valores SMB guardados.\n- Restaura el valor previo de la pol\u00edtica NTLM saliente.\n- Restaura el estado anterior del canal de eventos NTLM cuando pudo consultarse.\n- Restaura el tipo de inicio y estado del servicio WebClient cuando estaba disponible.\n\nLa reversi\u00f3n no desinstala actualizaciones de Office ni restaura cambios hechos por otras herramientas o por una GPO de dominio. Conserv\u00e1 el directorio de backup hasta verificar que todo funciona correctamente.\n\n---\n\n## 8. Active Directory, EPA y Protected Users\n\nEstas medidas son para entornos administrados; no deben aplicarse a ciegas en una PC personal.\n\n### NTLM saliente\n\nLa directiva correspondiente es:\n\n`Computer Configuration \u2192 Windows Settings \u2192 Security Settings \u2192 Local Policies \u2192 Security Options \u2192 Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers`\n\nSecuencia recomendada:\n1. Activar `Audit all`.\n2. Recopilar eventos y detectar dependencias.\n3. Migrar aplicaciones a Kerberos u otro m\u00e9todo moderno.\n4. Definir excepciones justificadas.\n5. Evaluar `Deny all` en una etapa controlada.\n\nUna GPO de dominio puede prevalecer sobre el valor local del registro.\n\n### SMB Signing\n\nLa firma SMB debe exigirse en los clientes y servidores que correspondan. Revis\u00e1 previamente los equipos y dispositivos que se conectan a los recursos compartidos.\n\n### Extended Protection for Authentication (EPA)\n\nEPA agrega protecciones de enlace de canal y de servicio a determinados flujos de autenticaci\u00f3n. Debe habilitarse en los servicios compatibles y probarse con los clientes correspondientes; no es una opci\u00f3n universal que se pueda activar desde un \u00fanico comando para todo Windows.\n\n### Protected Users\n\nEs un grupo de Active Directory destinado a cuentas privilegiadas o especialmente protegidas. No es un grupo al que se deba agregar indiscriminadamente a todos los usuarios: puede impedir autenticaciones y mecanismos heredados que algunas aplicaciones necesitan.\n\n---\n\n## 9. Protecci\u00f3n adicional recomendada\n\n1. **Microsoft Defender:** mantener protecci\u00f3n en tiempo real, protecci\u00f3n en la nube y firmas actualizadas.\n2. **Microsoft Office:** mantener las actualizaciones autom\u00e1ticas habilitadas.\n3. **Macros y documentos:** bloquear macros procedentes de Internet cuando corresponda y evaluar reglas ASR de Microsoft Defender.\n4. **Windows Hello:** preferir autenticaci\u00f3n moderna y resistente al phishing cuando est\u00e9 disponible.\n5. **MFA:** activar autenticaci\u00f3n multifactor en cuentas Microsoft y servicios cr\u00edticos.\n6. **Privilegios:** usar una cuenta est\u00e1ndar para las tareas cotidianas y reservar la cuenta administrativa para mantenimiento.\n7. **Archivos adjuntos:** no abrir archivos `.msg` ni documentos inesperados aunque parezcan provenir de un contacto conocido; confirmar el origen por un canal independiente.\n\n### Si se abri\u00f3 un archivo sospechoso antes de actualizar\n\n- Avisar al equipo de soporte o seguridad si el equipo pertenece a una organizaci\u00f3n.\n- Revisar los eventos de NTLM y las conexiones salientes.\n- Desde un dispositivo confiable, cambiar la contrase\u00f1a de la cuenta potencialmente afectada y revocar sesiones cuando corresponda.\n- Evaluar la exposici\u00f3n de otras cuentas y servicios a los que esa identidad tenga acceso.\n- No asumir que cambiar la contrase\u00f1a por s\u00ed solo elimina cualquier persistencia o sesi\u00f3n ya establecida.\n\n---\n\n## 10. Limitaciones conocidas\n\n- El script no instala la actualizaci\u00f3n de Outlook.\n- El bloqueo de TCP 445 hacia Internet no cubre WebDAV ni todos los mecanismos de autenticaci\u00f3n HTTP.\n- No bloquea todo NTLM del sistema: el modo por defecto audita el NTLM saliente y el bloqueo opcional se limita al cliente SMB.\n- SMB Signing no impide por s\u00ed solo que un atacante capture una respuesta NTLMv2.\n- El bloqueo de NTLM sobre SMB puede afectar NAS, servidores antiguos y recursos que no usan Kerberos.\n- Deshabilitar WebClient puede interrumpir unidades WebDAV.\n- La auditor\u00eda depende de la versi\u00f3n de Windows, el canal de eventos y las pol\u00edticas efectivas.\n- Las GPO de dominio pueden sobrescribir configuraciones locales.\n- No se garantiza compatibilidad con todas las versiones de Windows, controladores, dispositivos ni software de terceros.\n\n---\n\n## 11. Fuentes oficiales y referencias\n\n- [Microsoft Security Response Center \u2014 CVE-2026-124194](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-124194)\n- [Microsoft \u2014 Release notes for Microsoft Office security updates](https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates)\n- [Microsoft Learn \u2014 Control SMB signing behavior](https://learn.microsoft.com/en-us/windows-server/storage/file-server/smb-signing)\n- [Microsoft Learn \u2014 Block NTLM connections on SMB](https://learn.microsoft.com/en-us/windows-server/storage/file-server/smb-ntlm-blocking)\n- [Microsoft Support \u2014 NTLM auditing enhancements](https://support.microsoft.com/en-us/servicing/os/windows/2025/07/overview-of-ntlm-auditing-enhancements-in-windows-11-version-24h2-and-windows-server-2025)\n- [Microsoft Learn \u2014 Restrict NTLM: Outgoing NTLM traffic to remote servers](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers)\n\n---\n\n## 12. Publicar esta gu\u00eda en GitHub Gist\n\nEl archivo Markdown puede publicarse con GitHub CLI (`gh`).\n\n1. Instal\u00e1 GitHub CLI desde [cli.github.com](https://cli.github.com/).\n2. Autentic\u00e1 la cuenta:\n\n```powershell\ngh auth login\n```\n\n3. Desde la carpeta donde guardaste el Markdown, cre\u00e1 un Gist:\n\n```powershell\ngh gist create .\\Windows-NTLM-SMB-Hardening-CVE-2026-124194.md `\n    --desc \"Windows NTLM and SMB hardening - CVE-2026-124194\" `\n    --web\n```\n\nGitHub CLI crea un **Secret Gist** por defecto. Un Secret Gist no aparece en las b\u00fasquedas p\u00fablicas, pero cualquier persona que tenga el enlace puede verlo. Para crear un Gist p\u00fablico, agreg\u00e1 `--public` \u00fanicamente si quer\u00e9s que sea visible para cualquiera:\n\n```powershell\ngh gist create .\\Windows-NTLM-SMB-Hardening-CVE-2026-124194.md `\n    --desc \"Windows NTLM and SMB hardening - CVE-2026-124194\" `\n    --public\n```\n\nPara ver tus Gists:\n\n```powershell\ngh gist list\n```\n\n---\n\n**Nota final:** la prioridad frente a CVE-2026-124194 es instalar la actualizaci\u00f3n de Office que corrige el fallo. El hardening de SMB y NTLM agrega capas defensivas, pero no sustituye el parche.\n", "url": "https://gist.github.com/cristianbarreiro/b925bed110b3675246e7de841793b119"}, {"timestamp": "2026-11-12T16:54:09.473Z", "date_only": false, "value": "2026-11-12T16:54:09.473567Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hey-kira.bsky.social/post/3n24wojxhlt2q", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "6e4ce0c2-ba7d-4b8e-9a33-f6dceff5e044", "content": "Date check for anyone looking it up: CVE-2026-124194 shipped with the November updates, 10 Nov, not October. MSRC marks it Exploitation Detected. The CVE totals being quoted differ a lot between trackers, so prioritise what touches your estate, not the headline number.", "url": "https://bsky.app/profile/hey-kira.bsky.social/post/3n24wojxhlt2q"}, {"timestamp": "2026-11-12T18:51:37.855Z", "date_only": false, "value": "2026-11-12T18:51:37.855759Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hey-kira.bsky.social/post/3n255aj4jjy2c", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "6dc6dfb8-5141-4baa-bf43-f00f6ee9a606", "content": "The count depends on who counted: BleepingComputer says 1,235 flaws, Tenable's write-up 1,093 CVEs. Both agree on the one marked Exploitation Detected - CVE-2026-124194 in Outlook. Per MSRC. That's what decides your maintenance window, not the total.", "url": "https://bsky.app/profile/hey-kira.bsky.social/post/3n255aj4jjy2c"}, {"timestamp": "2026-11-12T19:15:26.889Z", "date_only": false, "value": "2026-11-12T19:15:26.889663Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/alt.pds.lefht.cc/post/3n256l5uguc2j", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "db6a5240-7fbd-4d21-9bea-eeba60e919d9", "content": "\ud83d\udee1\ufe0f Most-discussed CVEs on Bluesky, last 24h\n\n1. CVE-2026-119618 \u00b7 52 people\n2. CVE-2026-118383 \u00b7 19 people\n3. CVE-2026-124194 \u00b7 15 people \ud83d\udd25\n4. CVE-2026-125350 \u00b7 11 people \ud83d\udd25\n5. CVE-2026-12591 \u00b7 8 people\n\n\ud83d\udd25 = on CISA's Known Exploited list \u00b7 details in the thread \ud83e\uddf5", "url": "https://bsky.app/profile/alt.pds.lefht.cc/post/3n256l5uguc2j"}, {"timestamp": "2026-11-12T19:15:29.932Z", "date_only": false, "value": "2026-11-12T19:15:29.932969Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/alt.pds.lefht.cc/post/3n256l64qic2j", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "af7b9284-df2f-471b-8413-329ab3759f82", "content": "3. CVE-2026-124194 \u00b7 15 people \ud83d\udd25\n\ud83d\udfe8 Medium 6.5 \u00b7 Microsoft 365 Apps for Enterprise\n\nProduct ui does not warn user of unsafe actions in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.", "url": "https://bsky.app/profile/alt.pds.lefht.cc/post/3n256l64qic2j"}, {"timestamp": "2026-11-12T19:39:40.738Z", "date_only": false, "value": "2026-11-12T19:39:40.738951Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/five-oclick-tech.bsky.social/post/3n257w7ag7i2t", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "3a24fe8b-7e39-41b9-8563-8fc8876a8814", "content": "November Patch Tuesday: 1,000+ bugs, one zero-day \ud83e\udd2f\n\nMicrosoft fixed 1,094 bugs, including an Outlook zero-day (CVE-2026-124194) already exploited, plus two critical zero-click RCEs. This marks a second month over 1,000 CVEs, a new normal attributed to AI-driven bug hunting.", "url": "https://bsky.app/profile/five-oclick-tech.bsky.social/post/3n257w7ag7i2t"}, {"timestamp": "2026-11-12T21:50:37.532Z", "date_only": false, "value": "2026-11-12T21:50:37.532402Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/indirlab.com/post/3n25ham7qq22u", "record": "cve-2026-124194", "field": "creation_timestamp", "uuid": "64a90702-11b1-4d6c-b325-ba36acedbb86", "content": "Microsoft, Outlook'ta aktif olarak kullan\u0131lan CVE-2026-124194 a\u00e7\u0131\u011f\u0131 i\u00e7in uyar\u0131 verdi. Kimlik bilgilerinizi korumak i\u00e7in g\u00fcncellemeleri hemen kontrol edin. \ud83d\udc47\nhttps://indirlab.com/haber/outlook-kullanicilarina-kritik-uyari-cve-2026-124194-acigini-hemen-kapatin", "url": "https://bsky.app/profile/indirlab.com/post/3n25ham7qq22u"}, {"timestamp": "2026-11-13T01:00:16.321Z", "date_only": false, "value": "2026-11-13T01:00:16.321069Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehotdrop.live/post/3n25rtrc64k25", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "65b757d4-7152-4e57-910d-96e36c15c37c", "content": "An exploited Outlook zero-day (CVE-2026-124194) leaks NTLMv2 hashes when a crafted message file is opened. CISA's deadline is Nov 24.\n\nYouTube: www.youtube.com/shorts/sFhbq...\n\n#Cybersecurity #ZeroDay #PatchNow", "url": "https://bsky.app/profile/thehotdrop.live/post/3n25rtrc64k25"}, {"timestamp": "2026-11-13T01:53:39.644Z", "date_only": false, "value": "2026-11-13T01:53:39.644248Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/forsmile.jp/post/3n25ut3m5s223", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "5c08d19f-18ce-477b-8c3a-32f846a7df47", "content": "\u3010\u7dca\u6025\u3011Outlook CVE-2026-124194\uff1aCISA\u306e\u60aa\u7528\u78ba\u8a8dKEV\u306b\u8ffd\u52a0\uff08CVSS 6.5\uff09\n\n\u7d30\u5de5\u3055\u308c\u305f\u30e1\u30c3\u30bb\u30fc\u30b8\u30d5\u30a1\u30a4\u30eb\u3092\u958b\u304f\u3068\u3001\u30ed\u30b0\u30a4\u30f3\u7528\u30cf\u30c3\u30b7\u30e5\u304c\u6f0f\u308c\u308b\u6050\u308c\u3002\n\u5bfe\u51e6: Office\u3092\u66f4\u65b0\u3057\u3001Outlook\u3092\u518d\u8d77\u52d5\u3002\n\nforsmile.jp/articles/out...\n#\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3 #CVE", "url": "https://bsky.app/profile/forsmile.jp/post/3n25ut3m5s223"}, {"timestamp": "2026-11-13T03:27:27.948Z", "date_only": false, "value": "2026-11-13T03:27:27.948634Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/aman179102.bsky.social/post/3n2622d57r423", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "4e3d7a9c-5df9-4c06-b5bd-38e2b2c2bd34", "content": "If you use Microsoft Office, patch CVE-2026-124194 now. CISA confirms active exploitation. NVD rates the flaw 6.5 (MEDIUM). CISA set a 2026-11-24 remediation deadline for US federal agencies.\n#Security\nSources: NVD, CISA KEV", "url": "https://bsky.app/profile/aman179102.bsky.social/post/3n2622d57r423"}, {"timestamp": "2026-11-13T05:00:10.519Z", "date_only": false, "value": "2026-11-13T05:00:10.519878Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3n267aqxw2y2c", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "d5bfbdd4-6b6d-4f5f-9809-552488e3572c", "content": "Canada\u2019s Cyber Centre lists Microsoft products affected by vulnerabilities in its November 2026 rollup. An update says CISA added CVE-2026-124194 to its KEV Catalog and Microsoft indicates it has been exploited.", "url": "https://bsky.app/profile/hendryadrian.bsky.social/post/3n267aqxw2y2c"}, {"timestamp": "2026-11-13T08:41:39.647Z", "date_only": false, "value": "2026-11-13T08:41:39.647152Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hermesvector.bsky.social/post/3n26lmrxylv2h", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "e61e74bf-ec1e-4923-a288-e530eb19cf0b", "content": "Microsoft confirms Outlook outage as CISA adds exploited vulnerability to catalog\n\nMicrosoft confirmed a widespread Outlook outage on Thursday while CISA listed CVE-2026-124194, an actively exploited Outlook zero-day, in its Known Exploited Vulnerabilities catalog.", "url": "https://bsky.app/profile/hermesvector.bsky.social/post/3n26lmrxylv2h"}, {"timestamp": "2026-11-13T09:35:47.912Z", "date_only": false, "value": "2026-11-13T09:35:47.912563Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/digital-eye.bsky.social/post/3n26ondayw22j", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "b620fa1e-d480-408d-af1c-8ce21d65e44f", "content": "The flaw, tracked as CVE-2026-124194, allows attackers to compromise accounts\nwww.newsplus24.net/2026/11/urge...\n#MicrosoftOutlook #OutlookSecurityFlaw", "url": "https://bsky.app/profile/digital-eye.bsky.social/post/3n26ondayw22j"}, {"timestamp": "2026-11-13T10:40:35.032Z", "date_only": false, "value": "2026-11-13T10:40:35.032002Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newstecnicas.com/post/3n26sbcuw3k27", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "ae02b5fc-44e1-44c7-9d49-91fdc99f03cf", "content": "\ud83d\udee1\ufe0f #Alerta Cr\u00edtica en Microsoft #Outlook (CVE-2026-124194): An\u00e1lisis de la Explotaci\u00f3n Zero-Day, RCE en Azure DevOps y Protocolo de Mitigaci\u00f3n Urgente \n\nParchea la #vulnerabilidad Zero-Day en #Microsoft Outlook y protege tus sistemas corporativos hoy.\n\nwww.newstecnicas.com/2026/11/aler...", "url": "https://bsky.app/profile/newstecnicas.com/post/3n26sbcuw3k27"}, {"timestamp": "2026-11-13T11:24:16.107Z", "date_only": false, "value": "2026-11-13T11:24:16.107575Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/diginyze.bsky.social/post/3n26uoymfos26", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "1a337cc7-a928-4ba6-afc9-739995c3ec87", "content": "Microsoft is dealing with a global Outlook and Teams outage, days after patching CVE-2026-124194, an Outlook zero-day exploited in the wild.\n\n Patch, block outbound SMB, and test your fallback comms. \n\nGuide: www.diginyze.com/server-and-d... \n\n#DataSecurity #Outlook #Microsoft", "url": "https://bsky.app/profile/diginyze.bsky.social/post/3n26uoymfos26"}, {"timestamp": "2026-11-13T11:32:46.943Z", "date_only": false, "value": "2026-11-13T11:32:46.943159Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/techwhoknows.bsky.social/post/3n26v6rmsel25", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "a4862474-ec08-4635-a3b8-e827bde96dc2", "content": "Microsoft Patches 1,093 Vulnerabilities Including Exploited Outlook Zero-Day CVE-2026-124194\n\ntechwhoknows.com/security/microsoft-november-2026-patch-tuesday-outlook-zero-day", "url": "https://bsky.app/profile/techwhoknows.bsky.social/post/3n26v6rmsel25"}, {"timestamp": "2026-11-13T11:53:54.963Z", "date_only": false, "value": "2026-11-13T11:53:54.963750Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/darknetsearch.bsky.social/post/3n26we3pers2p", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "40c057b9-a190-47a2-a7c1-b3adceec633e", "content": "\ud83d\udea8 A critical Outlook zero-day (CVE-2026-124194) can expose NTLM credentials through malicious email files. Update Office immediately and avoid unexpected attachments.\n\n\ud83c\udf10 spoofguard.io/blog/en/outl...\n\n#CyberSecurity #CVE2026124194 #InfoSec #PatchManagement\n\nTry it for FREE. \ud83c\udd93", "url": "https://bsky.app/profile/darknetsearch.bsky.social/post/3n26we3pers2p"}, {"timestamp": "2026-11-13T12:02:36.674Z", "date_only": false, "value": "2026-11-13T12:02:36.674475Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thecybermind.co/post/3n26wu4hqgf26", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "952e1742-8f7b-4112-8335-b45ba4dc4a07", "content": "(CISA CS-MAN) The Cyber Mind CSUITE Brief: CVE-2026-124194 \u2013 Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action\u00a0Vulnerability\n\nExecutive risk and governance perspective on CVE-2026-124194, providing leadership with actionable compliance\u2026\n\nhttps://thecybermind.co/s3qa", "url": "https://bsky.app/profile/thecybermind.co/post/3n26wu4hqgf26"}, {"timestamp": "2026-11-13T12:03:45.547Z", "date_only": false, "value": "2026-11-13T12:03:45.547753Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thecybermind.co/post/3n26ww5n3un2t", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "8fd70523-a93b-4c38-a455-80234c6efbcc", "content": "(CISA TS+SOC) The Cyber Mind TSUITE Brief: CVE-2026-124194 \u2013 Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action\u00a0Vulnerability\n\nActionable threat intelligence on CVE-2026-124194 targeting Microsoft Outlook (Classic), featuring exploitation\u2026\n\nhttps://thecybermind.co/dj73", "url": "https://bsky.app/profile/thecybermind.co/post/3n26ww5n3un2t"}, {"timestamp": "2026-11-13T14:05:09.502Z", "date_only": false, "value": "2026-11-13T14:05:09.502650Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/kendarvesuvius.bsky.social/post/3n275paegrs2s", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "b50b259f-8246-46c3-9b20-dd84726efbb8", "content": "I kiiiinda wanna blame CVE-2026-124194 but am not an infosec nerd (nerd used affectionately)", "url": "https://bsky.app/profile/kendarvesuvius.bsky.social/post/3n275paegrs2s"}, {"timestamp": "2026-11-13T14:48:39.458Z", "date_only": false, "value": "2026-11-13T14:48:39.458116Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newstecnicas.com/post/3n27a4worvk24", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "11ca2597-aa8d-4081-8da8-a97f80eb6819", "content": "\ud83d\udee1\ufe0f #Alerta Cr\u00edtica en #Microsoft Outlook (CVE-2026-124194): An\u00e1lisis de la Explotaci\u00f3n Zero-Day, RCE en #Azure DevOps y Protocolo de #Mitigaci\u00f3n Urgente www.newstecnicas.com/2026/11/aler...", "url": "https://bsky.app/profile/newstecnicas.com/post/3n27a4worvk24"}, {"timestamp": "2026-11-13T15:13:31.944Z", "date_only": false, "value": "2026-11-13T15:13:31.944103Z", "kind": "sighting", "label": "Seen", "source": "https://poliverso.org/objects/0477a01e-db7a0f0e-13cd3346af076b6c", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "e6464d83-81c8-4115-960c-33748c109085", "content": "This Week In Security: Four-Digit Patch Tuesday, SSH Exploited, GitBook Breach, Android GhostMap\nIt\u2019s the second Tuesday of the month, and that means another Microsoft Patch Tuesday. The new normal is that the numbers are hard to believe. Brian Krebs reports that this month\u2019s release fixes nearly 1,100 vulnerabilities, 63 of them rated critical, and over 500 that let an attacker elevate their privileges. Only one is reported as actively exploited: CVE-2026-124194, a spoofing bug in Outlook. Microsoft has now shipped more than 5,100 security fixes this year, after more than 1,400 last month, compared to an average of around 100 a month last year. Obviously AI tools get the credit for the volume of bugs fixed, but also of course for the volume of bugs found.\nEveryone else is busy too. Apple pushed out-of-cycle updates for at least nine vulnerabilities across its operating systems, including an iMessage flaw which could let a remote attacker join a group chat and read its messages, and backported the fixes to iOS 18. Chrome 157 fixes CVE-2026-125350, another Chrome zero-day, a week after a Chrome release which fixed more than 200 bugs, Firefox 160 fixes almost 100 CVEs, and Adobe fixed more than 110.\nAlso since last week, zlib 1.4 shipped with more than a dozen security fixes, eight more vulnerabilities were disclosed in the X.Org server and XWayland, and Microsoft\u2019s own Azure Linux update lists more than 470 CVEs fixed across the open source packages it ships. And for a perfect encapsulation of 2026, last month\u2019s Patch Tuesday included a remote code execution bug in Windows Paint (CVE-2026-83844), though its description admits the code runs locally. So now I guess you can pop Calc through Paint? Does this count as a win?\nDespite the absolute firehose of vulnerabilities, the Krebs article notices that of the roughly 95,000 CVEs assigned this year, only around 200 made it into the CISA list of known expoited vulnerabilities (KEV). If you have to pick and choose which updates are the most critical, start there.\n*sshole under attack\nLast week we covered sshole, the bug where OpenSSH on musl libc without PAM accepts any long enough password for accounts that shouldn\u2019t take a password at all. (And we had a serious moment thinking about putting \u201csshole\u201d in the article title.) It now has a CVE, CVE-2026-123158, and Ars Technica reports that it\u2019s already being exploited. GreyNoise says honeypots it runs in Southeast Asia were hit by a group it tracks as GT10, which installed Python in order to run a backdoor with Chinese-language comments that appears to have been written with AI. WatchTowr reports exploitation tied to botnets and cryptocurrency, and Previdian has seen attempts from thirteen IP addresses in nine countries. CISA added it to its KEV catalog on November 9, with a deadline of just three days for federal agencies to patch.\nKevin Beaumont points out that, in practice, the affected population looks like Alpine Linux. Debian, Ubuntu, SUSE, Red Hat, and CentOS aren\u2019t affected, and neither is stock OpenWrt, which uses Dropbear instead of OpenSSH. The researcher who found the bug suggests checking other musl-based systems like OpenWrt with OpenSSH installed, Buildroot, and Yocto, along with \u201ca lot of the docker images you\u2019ve pulled.\u201d The OpenSSH 10.6p2 release notes credit \u00d6zg\u00fcn K\u00fcltekin of Wakefield with the report, and include a notable comment about the current state of things: the OpenSSH team has \u201cseen a number of cases where a security bug identified by AI tools is subsequently independently discovered by a different researcher,\u201d so they\u2019ll be making more frequent releases instead of batching fixes.\n\u201cType a really long password\u201d as a way past authentication isn\u2019t new, unfortunately. Back in 2014, a five-year-old found he could log into his dad\u2019s Xbox Live account by filling the password verification screen with spaces, and Microsoft added him to its list of credited security researchers. If you run Alpine anywhere with SSH reachable from the Internet, update OpenSSH, or at minimum turn off password logins with \u201cPasswordAuthentication no\u201d. I suppose it\u2019s the flip side of the password \u201c4\u201d for your certificate authority? (More on this below.)\nGitBook breached through its own login\nGitBook, the documentation platform used by a lot of open source and commercial projects, has published a post mortem on a breach on November 2. An attacker used a flaw in GitBook\u2019s single sign-on flow to create login sessions as GitBook staff, used those sessions to pull the credentials of a misconfigured GitHub App in GitBook\u2019s own organization, used that to get into GitBook\u2019s internal code repositories and eventually a Cloudflare API key, and used that key to get production secrets with full infrastructure access. If you tried to access documentation or manuals for something and it failed mysteriously, you might now know why.\nGitBook took the entire platform offline for about 16 hours while it rotated every secret, revoked API tokens, and rebuilt its infrastructure, which is a painful but correct call when you don\u2019t know what an attacker can still reach. GitBook believes the attack was aimed at a single customer, but is treating all customer data as exposed. That includes API and integration tokens, session signing secrets, and, most concerning, the ability to act as the GitBook app in any GitHub or GitLab repositories customers had connected to it. GitBook says it can\u2019t determine whether the attacker took any action in those repositories.\nEach step in that chain is a familiar mistake, but strung together they go from a login bug to the source code repositories of GitBook\u2019s customers. GitBook has already rotated the keys for its GitHub and GitLab sync, but if you use GitBook, create new API tokens and rotate any integration secrets, and if you\u2019ve connected it to your repositories, review recent commits and pull requests made by the GitBook app.\nGhostMap crashes Android until you wipe it\nBitdefender has found a way to lock an Android phone into a crash loop just by installing an app. The app requests no permissions, contains no code, and never has to be opened. A core system process reads a malformed file inside the app, crashes, restarts, reads it again, and crashes again. Rebooting doesn\u2019t help, and neither does safe mode; the only fix is a factory reset, unless USB debugging was already enabled and you can race the crashes to delete the file over ADB.\nAn Android app (APK) is really a ZIP file, and ZIP files store the same information, like file sizes and compression methods, in several places without requiring that they agree. Android reads each app many times, with separate pieces of code, to check its signature, install it, load its resources, and run it. When those readers disagree about what a file contains, you get bugs; past examples include the \u201cMaster Key\u201d bug (CVE-2013-4787), where Android checked the signature of one file and installed a different one with the same name, and Janus (CVE-2017-13156), where a single file could be both a validly signed APK and executable code at the same time. In this case, Android\u2019s ZIP library only checks the declared uncompressed size against the real file for entries marked as uncompressed, while the code that loads app resources treats anything not marked as compressed as uncompressed. An entry with an unusual compression method and a bogus size slips between the two, Android maps memory past the end of the file, and the process crashes when it tries to read it.\nBitdefender found the bug when a banking malware sample, mangled by a packer, crashed its analysis systems, and reproduced the crash loop on a Pixel 10 running Android 17 with the August 2026 security patch; it affects Android 10 and newer. Google closed the report as not a security issue, and says it has passed it on to a feature team. A phone that can be bricked by a zero-permission app sounds like a security issue to me, and Bitdefender points out that Google rated a similar factory-reset bug as a security fix back in 2016. Be careful what you sideload.\nFollow-ups: eMudhra, freezers, and MPTCP\neMudhra has published its full post-incident report, and the Indian Express has a summary of how its certificate authority ended up with private keys as small as \u201c4\u201d. The keys were generated correctly in a hardware security module, but eMudhra needed to move them to new facilities in the US and EU, and wrote its own Python script to wrap and unwrap them for transport. During a rehearsal in April 2025, the script read the unwrapped key back incorrectly, truncating it, and created a new key from the result. Nobody checked the key strength or compared the certified public key to the original, the bad copy had an almost identical label, and the weak certificates passed two audit cycles. eMudhra also revealed it revoked eight more RSA keys on November 7, after previously saying they were unaffected, because it can\u2019t show they were handled properly. BleepingComputer notes that the problem could have been caught more than a year earlier: in June 2025, eMudhra noticed certificate revocation lists signed with keys that didn\u2019t match its CA certificates.\nThe fallout makes a good case for taking revocation more seriously. Ubuntu 26.10 has started rolling out upki, a Rust project which brings browser-style certificate revocation checking to the rest of the operating system, starting with curl, with OpenSSL support planned for 27.04. And in a lighter take, a thread on Mastodon demonstrates \u201cvanity\u201d RSA keys with readable messages embedded in the public key, including \u201cA certificate authority almost got away with the number 4\u201d.\nIn more serious follow-ups, France has formally accused Iran\u2019s Islamic Revolutionary Guard Corps of the supermarket refrigeration attacks last month. Foreign Minister Jean-No\u00ebl Barrot called it \u201cthe first large-scale cyber-attack aimed at sabotage on our national territory,\u201d summoned the Iranian ambassador, and promised sanctions, and the Paris prosecutor has opened an investigation into the head of Shahid Kaveh, an IRGC cyber unit previously linked to attacks on industrial controllers at US water utilities, and two of his deputies. Iran\u2019s foreign ministry has rejected the accusation. It\u2019s still not known whether the attacks elsewhere in Europe that we covered last week are related. Researchers have also found multiple exploitable vulnerabilities in the control software of the freezers, beyond the risk of default passwords, but all the articles referencing them appear to be paywalled at the moment.\nFinally, Ubuntu now lists fixed kernels for the Linux MPTCP remote code execution bug from last week on 22.04, 24.04, 26.04, and 26.10. Fixes for the older 16.04, 18.04, and 20.04 releases are still in progress. Red Hat has raised its rating to Critical and has been shipping fixed kernels for RHEL 8, 9, and 10 since November 1, with OpenShift updates following this week. Both Red Hat and Ubuntu now stress that the bug isn\u2019t specific to MPTCP. MPTCP only comes into it because that\u2019s what Anthropic\u2019s exploit used, so turning MPTCP off isn\u2019t a fix, and Red Hat says OpenShift nodes in their default configuration, with MPTCP disabled, are still affected.\nThe good news, for now, is that nobody else seems to have a working exploit. Anthropic still hasn\u2019t released its exploit, and as of October 30 TuxCare hadn\u2019t reproduced it, and no independent public reproduction had turned up. The closest thing public is a proof-only PoC on GitHub which wins the race and detects the kernel leaking freed memory into a SYN-ACK, but stops well short of code execution. The Stack and BleepingComputer both report no confirmed exploitation in the wild, and the bug still isn\u2019t in CISA\u2019s KEV catalog. The scanning Hutchins saw last week suggests someone is preparing for the day a working exploit shows up.\nMaking Firefox harder to fingerprint\nBrowser fingerprinting identifies a browser without cookies, by combining lots of individually boring details: installed fonts, screen size, graphics hardware, how the audio system rounds numbers, and so on. Back in August, we saw AliExpress using audio fingerprinting to identify visitors. Mozilla has now published research, accepted at the ACM CCS conference, measuring which details actually make Firefox users unique, using data from almost 25 million users collected through privacy-preserving relays.\nThe research is behind a set of fairly small changes, shipped over the past year starting with Firefox 143, which add up. Firefox hides the size and position of the taskbar or dock from screen size measurements, reports the number of CPU cores as either 4 or 8 instead of the real count, and fixes inconsistencies in image rendering, Web Audio, and math on Android that made some users stand out. According to the study\u2019s companion site, the percentage of users who could be uniquely identified by the most effective of three commercial fingerprinting scripts dropped from 75% to 46%. Some protections are only on by default in Private Browsing and Strict tracking protection for now. The site also has a test you can run to see how unique your own browser looks.\nFunding post-quantum certificates\nLet\u2019s Encrypt has received more than \u20ac1 million from Germany\u2019s Sovereign Tech Agency to build a Merkle Tree Certificate authority, its largest single investment in post-quantum readiness so far. Post-quantum signature algorithms are much larger than the ones used today, and replacing every signature in a TLS handshake with a post-quantum one would push the handshake well past 10 kilobytes, slowing all connections and breaking others. Merkle Tree Certificates keep things small by covering a whole batch of certificates with a single signature. The funding runs through the end of 2027, covering standards work and a production launch.\nIncident response is a growth industry\nVanderbilt University told everyone on campus to shut down university devices and disconnect from university WiFi on Monday while it responds to an active cybersecurity incident, and to report anything suspicious from a separate device. Vanderbilt Health, which is a separate organization, says its systems haven\u2019t been affected. On Tuesday, a ransomware group calling itself BYOD claimed the attack, and says it stole Social Security numbers and records for more than a million students and employees. Vanderbilt hasn\u2019t commented on the claim.\nIf it feels like these announcements are getting more common, Sophos agrees. In a post on incident response demand, it argues that AI is less about new kinds of attacks and more about attackers running the same playbook faster and at larger scale, while defenders can\u2019t patch at the same speed. Sophos says two thirds of the intrusions it investigated started with compromised credentials or other identity attacks, and attackers reached Active Directory in an average of under three and a half hours. Everyone, it says, is hiring incident responders. \nhackaday.com/2026/11/13/this-w\u2026RE: cyberplace.social/users/GossiT\u2026", "url": "https://poliverso.org/objects/0477a01e-db7a0f0e-13cd3346af076b6c"}, {"timestamp": "2026-11-13T15:29:21.856Z", "date_only": false, "value": "2026-11-13T15:29:21.856339Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/youranonirc.bsky.social/post/3n27cftiymj2g", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "d41834ae-10e9-42e6-9c17-5a66f305d568", "content": "OpSec Alert: US disrupts FaceStealer crypto theft, 900+ webcams seized. Outlook 0-day (CVE-2026-124194) actively exploited. Patch N-central critical flaws NOW. Stay secure. #Cybersecurity #Anonymous #OpSec", "url": "https://bsky.app/profile/youranonirc.bsky.social/post/3n27cftiymj2g"}, {"timestamp": "2026-11-13T16:43:18.933Z", "date_only": false, "value": "2026-11-13T16:43:18.933793Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/dal0028751.bsky.social/post/3n27hdflr7s2b", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "682558f5-81ee-4fd4-8ab4-3835b07c4bb5", "content": "Microsoft recently addressed an actively exploited Outlook security flaw (CVE-2026-124194) that lets attackers steal login credentials and spy on emails, while also rolling out a new anti-tracking image blocker to stop hidden email spies.+", "url": "https://bsky.app/profile/dal0028751.bsky.social/post/3n27hdflr7s2b"}, {"timestamp": "2026-11-13T17:30:07.857Z", "date_only": false, "value": "2026-11-13T17:30:07.857999Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3n27j5rfxzc2h", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "2e03cfe5-4b9d-4509-90a1-62be2d6d0b2c", "content": "\ud83d\udce2 Patch Tuesday novembre 2026 : zero-day Outlook CVE-2026-124194 exploit\u00e9 activement\n\nCet article couvre le Patch Tuesday de novembre 2026 de Microsoft. \ud83d\udd0d Vuln\u00e9rabilit\u00e9 principale Le zero-day CVE-2026-124194 affecte Microsoft\u2026\n\n\ud83d\udfe2 v\u00e9rification factuelle haute\n#Outlook #PatchTuesday #Cyberveille", "url": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3n27j5rfxzc2h"}, {"timestamp": "2026-11-13T17:32:38.271Z", "date_only": false, "value": "2026-11-13T17:32:38.271204Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/aiuto-ch.bsky.social/post/3n27jc7lx4khc", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "6c917906-c260-4997-9269-221f8da5906c", "content": "CISA KEV | CVE-2026-124194 | Microsoft / Office\n\nCISA lists this vulnerability as exploited in the wild. Check affected products and vendor guidance.\n\nSource: CISA KEV\n\nFull analysis: https://t.me/aiutocomputerhelp_lab/1420", "url": "https://bsky.app/profile/aiuto-ch.bsky.social/post/3n27jc7lx4khc"}, {"timestamp": "2026-11-13T18:11:07.384Z", "date_only": false, "value": "2026-11-13T18:11:07.384Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-124194", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-13T18:11:07.384Z", "date_only": false, "value": "2026-11-13T18:11:07.384Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / microsoft", "record": "CVE-2026-124194", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-13T20:42:48.595Z", "date_only": false, "value": "2026-11-13T20:42:48.595012Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3n27tw4jf522f", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "98076e03-4fdc-4ed9-8118-d181f6caadde", "content": "5/ Not a hack, but not risk-free: Defender Safe Links and Defender XDR were degraded for hours. Plus, an exploited Outlook bug (CVE-2026-124194) was patched Nov 10. Patch now if you haven't.", "url": "https://bsky.app/profile/sergioiker.bsky.social/post/3n27tw4jf522f"}, {"timestamp": "2026-11-13T20:42:49.068Z", "date_only": false, "value": "2026-11-13T20:42:49.068419Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3n27twbl3ws2f", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "35e60afc-c284-448b-a181-02450a60078e", "content": "5/ Not a hack, but not risk-free: Defender Safe Links and Defender XDR were degraded for hours. Plus, an exploited Outlook bug (CVE-2026-124194) was patched Nov 10. Patch now if you haven't.", "url": "https://bsky.app/profile/sergioiker.bsky.social/post/3n27twbl3ws2f"}, {"timestamp": "2026-11-13T20:42:49.547Z", "date_only": false, "value": "2026-11-13T20:42:49.547822Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3n27twblbsc2f", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "e3e26220-3f1f-453c-b9a3-a75a1d6db514", "content": "5/ Not a hack, but not risk-free: Defender Safe Links and Defender XDR were degraded for hours. Plus, an exploited Outlook bug (CVE-2026-124194) was patched Nov 10. Patch now if you haven't.", "url": "https://bsky.app/profile/sergioiker.bsky.social/post/3n27twblbsc2f"}, {"timestamp": "2026-11-13T20:42:50.030Z", "date_only": false, "value": "2026-11-13T20:42:50.030169Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3n27twblklk2f", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "bdaa69bd-ef50-49a6-9c8d-ef10883f60d8", "content": "5/ Not a hack, but not risk-free: Defender Safe Links and Defender XDR were degraded for hours. Plus, an exploited Outlook bug (CVE-2026-124194) was patched Nov 10. Patch now if you haven't.", "url": "https://bsky.app/profile/sergioiker.bsky.social/post/3n27twblklk2f"}, {"timestamp": "2026-11-13T20:42:50.497Z", "date_only": false, "value": "2026-11-13T20:42:50.497956Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3n27twblsfk2f", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "48fc4396-b3ab-4d68-aa10-da8b0cab18d9", "content": "5/ Not a hack, but not risk-free: Defender Safe Links and Defender XDR were degraded for hours. Plus, an exploited Outlook bug (CVE-2026-124194) was patched Nov 10. Patch now if you haven't.", "url": "https://bsky.app/profile/sergioiker.bsky.social/post/3n27twblsfk2f"}, {"timestamp": "2026-11-13T20:42:50.964Z", "date_only": false, "value": "2026-11-13T20:42:50.964858Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3n27twblvdc2f", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "2efa789d-df68-4d2e-a1bf-6786f2a30d11", "content": "5/ Not a hack, but not risk-free: Defender Safe Links and Defender XDR were degraded for hours. Plus, an exploited Outlook bug (CVE-2026-124194) was patched Nov 10. Patch now if you haven't.", "url": "https://bsky.app/profile/sergioiker.bsky.social/post/3n27twblvdc2f"}, {"timestamp": "2026-11-13T20:42:51.457Z", "date_only": false, "value": "2026-11-13T20:42:51.457428Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3n27twblvdd2f", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "12a79f1b-665c-4614-94a0-c06a44ab5b67", "content": "5/ Not a hack, but not risk-free: Defender Safe Links and Defender XDR were degraded for hours. Plus, an exploited Outlook bug (CVE-2026-124194) was patched Nov 10. Patch now if you haven't.", "url": "https://bsky.app/profile/sergioiker.bsky.social/post/3n27twblvdd2f"}, {"timestamp": "2026-11-13T20:42:51.936Z", "date_only": false, "value": "2026-11-13T20:42:51.936057Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3n27twblyb32f", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "0f76d323-d3e3-4635-8fd0-91c6e340d1f2", "content": "5/ Not a hack, but not risk-free: Defender Safe Links and Defender XDR were degraded for hours. Plus, an exploited Outlook bug (CVE-2026-124194) was patched Nov 10. Patch now if you haven't.", "url": "https://bsky.app/profile/sergioiker.bsky.social/post/3n27twblyb32f"}, {"timestamp": "2026-11-13T22:48:12.321Z", "date_only": false, "value": "2026-11-13T22:48:12.321775Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/deramin.bsky.social/post/3n2a2wjyszk2u", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "8cadfef7-df54-4070-97f6-0232a791fa5e", "content": "\u201cAccording to Redmond, just one of the flaws is already seeing active exploitation: CVE-2026-124194, a spoofing bug in Outlook. The advisory for CVE-2026-124194 says it affects Microsoft 365 Apps for Enterprise and editions of Microsoft Office.\u201d", "url": "https://bsky.app/profile/deramin.bsky.social/post/3n2a2wjyszk2u"}, {"timestamp": "2026-11-13T22:48:12.817Z", "date_only": false, "value": "2026-11-13T22:48:12.817642Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/deramin.bsky.social/post/3n2a2wjzcnk2u", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "6d8614b2-121c-4088-9f2d-a66c9dbf641b", "content": "\u201cAccording to Redmond, just one of the flaws is already seeing active exploitation: CVE-2026-124194, a spoofing bug in Outlook. The advisory for CVE-2026-124194 says it affects Microsoft 365 Apps for Enterprise and editions of Microsoft Office.\u201d", "url": "https://bsky.app/profile/deramin.bsky.social/post/3n2a2wjzcnk2u"}, {"timestamp": "2026-11-13T22:48:13.278Z", "date_only": false, "value": "2026-11-13T22:48:13.278522Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/deramin.bsky.social/post/3n2a2wjzdms2u", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "a330669d-eb9e-4ed6-9971-6a768d408148", "content": "\u201cAccording to Redmond, just one of the flaws is already seeing active exploitation: CVE-2026-124194, a spoofing bug in Outlook. The advisory for CVE-2026-124194 says it affects Microsoft 365 Apps for Enterprise and editions of Microsoft Office.\u201d", "url": "https://bsky.app/profile/deramin.bsky.social/post/3n2a2wjzdms2u"}, {"timestamp": "2026-11-13T22:48:13.747Z", "date_only": false, "value": "2026-11-13T22:48:13.747544Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/deramin.bsky.social/post/3n2a2wjzem22u", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "62b1776c-f34b-4ace-a876-fb8e78e56097", "content": "\u201cAccording to Redmond, just one of the flaws is already seeing active exploitation: CVE-2026-124194, a spoofing bug in Outlook. The advisory for CVE-2026-124194 says it affects Microsoft 365 Apps for Enterprise and editions of Microsoft Office.\u201d", "url": "https://bsky.app/profile/deramin.bsky.social/post/3n2a2wjzem22u"}, {"timestamp": "2026-11-13T22:48:14.243Z", "date_only": false, "value": "2026-11-13T22:48:14.243521Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/deramin.bsky.social/post/3n2a2wjzflc2u", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "acb1c4f6-12b7-4f8e-8ec2-ccd5b7e5d840", "content": "\u201cAccording to Redmond, just one of the flaws is already seeing active exploitation: CVE-2026-124194, a spoofing bug in Outlook. The advisory for CVE-2026-124194 says it affects Microsoft 365 Apps for Enterprise and editions of Microsoft Office.\u201d", "url": "https://bsky.app/profile/deramin.bsky.social/post/3n2a2wjzflc2u"}, {"timestamp": "2026-11-13T22:48:14.755Z", "date_only": false, "value": "2026-11-13T22:48:14.755165Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/deramin.bsky.social/post/3n2a2wjzgkk2u", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "7aa6cb08-e549-4e9b-85d6-58d3cd0843eb", "content": "\u201cAccording to Redmond, just one of the flaws is already seeing active exploitation: CVE-2026-124194, a spoofing bug in Outlook. The advisory for CVE-2026-124194 says it affects Microsoft 365 Apps for Enterprise and editions of Microsoft Office.\u201d", "url": "https://bsky.app/profile/deramin.bsky.social/post/3n2a2wjzgkk2u"}, {"timestamp": "2026-11-13T22:48:15.221Z", "date_only": false, "value": "2026-11-13T22:48:15.221415Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/deramin.bsky.social/post/3n2a2wjzgkl2u", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "b1ec6331-debd-4637-82d1-0254394cad5d", "content": "\u201cAccording to Redmond, just one of the flaws is already seeing active exploitation: CVE-2026-124194, a spoofing bug in Outlook. The advisory for CVE-2026-124194 says it affects Microsoft 365 Apps for Enterprise and editions of Microsoft Office.\u201d", "url": "https://bsky.app/profile/deramin.bsky.social/post/3n2a2wjzgkl2u"}, {"timestamp": "2026-11-13T22:48:15.686Z", "date_only": false, "value": "2026-11-13T22:48:15.686585Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/deramin.bsky.social/post/3n2a2wjzhjt2u", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "a975f493-3a5a-428d-9a94-c8c25b06883e", "content": "\u201cAccording to Redmond, just one of the flaws is already seeing active exploitation: CVE-2026-124194, a spoofing bug in Outlook. The advisory for CVE-2026-124194 says it affects Microsoft 365 Apps for Enterprise and editions of Microsoft Office.\u201d", "url": "https://bsky.app/profile/deramin.bsky.social/post/3n2a2wjzhjt2u"}, {"timestamp": "2026-11-14T00:02:01.757Z", "date_only": false, "value": "2026-11-14T00:02:01.757151Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hermesvector.bsky.social/post/3n2a72jyqms2t", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "97f77c23-7c7c-4377-a9e0-280ae362aaeb", "content": "Microsoft Patches Actively Exploited Outlook Zero-Day That Exposes NTLM Hashes\n\nMicrosoft has patched CVE-2026-124194, an actively exploited Outlook spoofing vulnerability that can expose a user's NTLMv2 authentication information when a specially crafted message file is opened.", "url": "https://bsky.app/profile/hermesvector.bsky.social/post/3n2a72jyqms2t"}, {"timestamp": "2026-11-24T00:00:00Z", "date_only": true, "value": "2026-11-24", "kind": "kev", "label": "Due date", "source": "cisa-kev", "record": "CVE-2026-124194", "field": "evidence.0.details.due_date", "uuid": "18197b96-abfb-460f-bfda-3ddc05096729", "status": {"status_reason": "confirmed", "exploited": true}}], "metrics": {"as_of": "2026-11-14T04:47:51.987Z", "anchors": {"origin": {"timestamp": "2026-11-10T16:00:00Z", "date_only": false, "value": "2026-11-10T16:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / microsoft", "record": "CVE-2026-124194", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-11-10T16:00:00Z", "date_only": false, "value": "2026-11-10T16:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / microsoft", "record": "CVE-2026-124194", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": {"timestamp": "2026-11-11T02:00:07Z", "date_only": false, "value": "2026-11-11T02:00:07.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/110036", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "c24e89e9-587c-435d-891e-3b8abc97eb4f", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-124194-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a AmesianX\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-11-11 01:37:18\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-124194 PoC - Outlook spoofing/forced-authentication NTLM leak (patched 2026-11). Concept proof only, untested against vulnerable Outlook.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/110036", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": {"timestamp": "2026-11-10T00:00:00Z", "date_only": false, "value": "2026-11-10T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2026-124194", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "18197b96-abfb-460f-bfda-3ddc05096729", "status": {"status_reason": "confirmed", "exploited": true}}, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": true, "seconds": -57600.0, "hours": -16.0, "days": -0.6666666666666666, "min_seconds": -57600.0, "max_seconds": 28800.0, "approximate": true, "ongoing": false, "order_known": false, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-10T16:00:00Z", "date_only": false, "value": "2026-11-10T16:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / microsoft", "record": "CVE-2026-124194", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-10T00:00:00Z", "date_only": false, "value": "2026-11-10T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2026-124194", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "18197b96-abfb-460f-bfda-3ddc05096729", "status": {"status_reason": "confirmed", "exploited": true}}}, "disclosure_to_exploit": {"available": true, "seconds": -57600.0, "hours": -16.0, "days": -0.6666666666666666, "min_seconds": -57600.0, "max_seconds": 28800.0, "approximate": true, "ongoing": false, "order_known": false, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-10T16:00:00Z", "date_only": false, "value": "2026-11-10T16:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / microsoft", "record": "CVE-2026-124194", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-10T00:00:00Z", "date_only": false, "value": "2026-11-10T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2026-124194", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "18197b96-abfb-460f-bfda-3ddc05096729", "status": {"status_reason": "confirmed", "exploited": true}}}, "disclosure_to_exploit_publication": {"available": true, "seconds": 36007.0, "hours": 10.001944444444444, "days": 0.4167476851851852, "min_seconds": 36007.0, "max_seconds": 36007.0, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-10T16:00:00Z", "date_only": false, "value": "2026-11-10T16:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / microsoft", "record": "CVE-2026-124194", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-11T02:00:07Z", "date_only": false, "value": "2026-11-11T02:00:07.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/110036", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "c24e89e9-587c-435d-891e-3b8abc97eb4f", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-124194-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a AmesianX\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-11-11 01:37:18\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-124194 PoC - Outlook spoofing/forced-authentication NTLM leak (patched 2026-11). Concept proof only, untested against vulnerable Outlook.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/110036", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 305271.987707, "hours": 84.79777436305555, "days": 3.533240598460648, "min_seconds": 305271.987707, "max_seconds": 305271.987707, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-10T16:00:00Z", "date_only": false, "value": "2026-11-10T16:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / microsoft", "record": "CVE-2026-124194", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-14T04:47:51.987Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": true, "seconds": 362871.987707, "hours": 100.79777436305555, "days": 4.199907265127314, "min_seconds": 276471.987707, "max_seconds": 362871.987707, "approximate": true, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-10T00:00:00Z", "date_only": false, "value": "2026-11-10T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2026-124194", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "18197b96-abfb-460f-bfda-3ddc05096729", "status": {"status_reason": "confirmed", "exploited": true}}, "end": {"timestamp": "2026-11-14T04:47:51.987Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploit_publication_to_patch": {"available": true, "seconds": 269264.987707, "hours": 74.7958299186111, "days": 3.116492913275463, "min_seconds": 269264.987707, "max_seconds": 269264.987707, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-11T02:00:07Z", "date_only": false, "value": "2026-11-11T02:00:07.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/110036", "record": "CVE-2026-124194", "field": "creation_timestamp", "uuid": "c24e89e9-587c-435d-891e-3b8abc97eb4f", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-124194-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a AmesianX\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-11-11 01:37:18\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-124194 PoC - Outlook spoofing/forced-authentication NTLM leak (patched 2026-11). Concept proof only, untested against vulnerable Outlook.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/110036", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-11-14T04:47:51.987Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}