Continuous enterprise threat intelligence tracking active in-the-wild zero-days (CISA KEV), Microsoft Windows KB cumulative updates, MSRC security advisories, and CVE remediation.
Added SQL software to the Security Updates table. Customers that are running supported version of SQL are encouraged to update to the indicated version to be protected from this vulnerability.
Updated an acknowledgement. This is an informational change only.
Starting with Windows updates released on and after October 13, 2026, Microsoft is making hardening changes to the [Resilient File System (ReFS)](https://learn.microsoft.com/windows-server/storage/refs/refs-overview). This change is not enable by default until 2027. Please see [Hardening changes for ReFS volumes on removable media](https://support.microsoft.com/en-us/servicing/os/windows/docs/2026/10/hardening-changes-for-refs-volumes-on-removable-media) for more information.
Incorrect permission assignment for critical resource in Windows Mobile Broadband allows an authorized attacker to elevate privileges locally.
Stack-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network.
Missing authentication for critical function in Windows Health and Optimized Experiences Service allows an authorized attacker to disclose information locally.
Out-of-bounds read in Microsoft Office Access allows an unauthorized attacker to disclose information over a network.
Heap-based buffer overflow in Windows Bluetooth Port Driver allows an authorized attacker to elevate privileges locally.
Untrusted pointer dereference in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
Improper verification of cryptographic signature in Windows Update Stack allows an authorized attacker to perform spoofing locally.
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
Improper link resolution before file access ('link following') in Windows Update Orchestrator Service allows an authorized attacker to elevate privileges locally.
Insufficient verification of data authenticity in Windows DHCP Server allows an authorized attacker to bypass a security feature locally.
Absolute path traversal in Windows Encrypting File System (EFS) allows an authorized attacker to elevate privileges over a network.
Use after free in Windows CCFFilter Driver allows an unauthorized attacker to execute code over a network.
Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.
Out-of-bounds read in Microsoft Bluetooth Driver allows an unauthorized attacker to elevate privileges with a physical attack.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an authorized attacker to elevate privileges locally.
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
Out-of-bounds read in Microsoft Bluetooth Driver allows an authorized attacker to disclose information locally.
Improper control of generation of code ('code injection') in Windows Encrypting File System (EFS) allows an authorized attacker to execute code over a network.
Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to execute code locally.
Heap-based buffer overflow in OpenSSH for Windows allows an unauthorized attacker to execute code over a network.