Search threats, CVEs… ⌘K
Vendor advisories

Microsoft Security Response Center

Browse 15,943 advisories from this official source. Search by product, CVE, severity, or advisory ID.

Current Checked 25 minutes ago Checked every 6 hours
All vendor sources Official source

15,943 advisories

Each date says whether the vendor published or updated the bulletin. A vendor bulletin describes products that may be affected. It does not prove that the vulnerable product or version is installed in your environment.

RSS for these results
Microsoft Security Response CenterCVE-2026-85922
HighCVSS 7.4

Azure Key Vault Security Feature Bypass Vulnerability

Weak authentication in Azure Key Vault allows an unauthorized attacker to bypass a security feature over a network.

Affected productsazure-keyvault-secrets, azure-keyvault-keys, azure-keyvault-certificates, azure-keyvault-administration
Fixed versions4.11.2, 4.7.1, 1.0.0b3, 1.0.1
Vendor guidance

Release Notes

CVE-2026-85922
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-85920
HighCVSS 7.0

Windows BitLocker Elevation of Privilege Vulnerability

Time-of-check time-of-use (toctou) race condition in Windows BitLocker allows an authorized attacker to elevate privileges locally.

Affected productsWindows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019, Windows Server 2019 (Server Core installation)
Fixed versions10.0.17763.9376, 10.0.20348.5761, 10.0.19044.7807, 10.0.19045.7807
Vendor guidance

Install KB5126651. Install KB5126655. Install KB5126657. Install KB5126646. Install KB5127648. Install KB5126653. Install KB5127646. Install KB5126868. Install KB5126835. Install KB5126836.

CVE-2026-85920
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-85919
HighCVSS 7.0

Microsoft SQL Server Elevation of Privilege Vulnerability

Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges locally.

Affected productsMicrosoft SQL Server 2022 for x64-based Systems (CU27), Microsoft SQL Server 2025 for x64-based Systems (CU9), Microsoft SQL Server 2025 for x64-based Systems (GDR), Microsoft SQL Server 2019 for x64-based Systems (GDR)
Fixed versions16.0.4305.5, 17.0.5015.4, 17.0.1145.4, 15.0.2200.2
Vendor guidance

Install KB5126934. Install KB5126967. Install KB5128492. Install KB5128495. Install KB5128494. Install KB5128493.

CVE-2026-85919
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-85918
HighCVSS 7.0

Windows Universal Plug and Play (UPnP) Device Host Elevation of Privilege Vulnerability

Use after free in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally.

Affected productsWindows 11 Version 26H2 for ARM64-based Systems, Windows 11 Version 26H2 for x64-based Systems, Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems
Fixed versions10.0.26300.9711, 10.0.17763.9376, 10.0.20348.5761, 10.0.19044.7807
Vendor guidance

Install KB5127648. Install KB5126651. Install KB5126655. Install KB5126657. Install KB5126646. Install KB5126653. Install KB5127646. Install KB5126868. Install KB5126835. Install KB5126836.

CVE-2026-85918
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-85916
HighCVSS 6.2

Azure Active Directory Information Disclosure Vulnerability

Exposure of private personal information to an unauthorized actor in Azure Active Directory allows an unauthorized attacker to disclose information locally.

Affected productsWindows 11 Version 26H2 for ARM64-based Systems, Windows 11 Version 26H2 for x64-based Systems, Windows Server 2025 (Server Core installation), Windows 11 Version 25H2 for ARM64-based Systems
Fixed versions10.0.26300.9711, 10.0.26100.33650, 10.0.26200.9711, 10.0.22631.7652
Vendor guidance

Install KB5127648. Install KB5126646. Install KB5126653. Install KB5127646.

CVE-2026-85916
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-85915
HighCVSS 7.8

Windows PCI Bus Driver Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows PCI Bus Driver allows an authorized attacker to elevate privileges locally.

Affected productsWindows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019, Windows Server 2019 (Server Core installation)
Fixed versions10.0.17763.9376, 10.0.20348.5761, 10.0.19044.7807, 10.0.19045.7807
Vendor guidance

Install KB5126651. Install KB5126655. Install KB5126657. Install KB5126646. Install KB5127648. Install KB5126653. Install KB5127646.

CVE-2026-85915
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-85914
HighCVSS 7.0

Windows Embedded Mode Service Elevation of Privilege Vulnerability

Use after free in Windows Embedded Mode Service allows an authorized attacker to elevate privileges locally.

Affected productsWindows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019, Windows Server 2019 (Server Core installation)
Fixed versions10.0.17763.9376, 10.0.20348.5761, 10.0.19044.7807, 10.0.19045.7807
Vendor guidance

Install KB5126651. Install KB5126655. Install KB5126657. Install KB5126646. Install KB5127648. Install KB5126653. Install KB5127646. Install KB5126868.

CVE-2026-85914
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-85912
HighCVSS 7.0

Clipboard User Service Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Clipboard User Service allows an authorized attacker to elevate privileges locally.

Affected productsWindows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019, Windows Server 2019 (Server Core installation)
Fixed versions10.0.17763.9376, 10.0.20348.5761, 10.0.19044.7807, 10.0.19045.7807
Vendor guidance

Install KB5126651. Install KB5126655. Install KB5126657. Install KB5126646. Install KB5127648. Install KB5126653. Install KB5127646. Install KB5126868.

CVE-2026-85912
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-85911
HighCVSS 7.8

Windows StateRepository API Elevation of Privilege Vulnerability

Use after free in Windows StateRepository API allows an authorized attacker to elevate privileges locally.

Affected productsWindows 11 Version 26H2 for ARM64-based Systems, Windows 11 Version 26H2 for x64-based Systems, Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems
Fixed versions10.0.26300.9711, 10.0.17763.9376, 10.0.20348.5761, 10.0.19044.7807
Vendor guidance

Install KB5127648. Install KB5126651. Install KB5126655. Install KB5126657. Install KB5126646. Install KB5126653. Install KB5127646.

CVE-2026-85911
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-85910
HighCVSS 5.5

Windows StateRepository API Information Disclosure Vulnerability

Buffer over-read in Windows StateRepository API allows an authorized attacker to disclose information locally.

Affected productsWindows Server 2025 (Server Core installation), Windows 11 Version 25H2 for ARM64-based Systems, Windows 11 Version 25H2 for x64-based Systems, Windows 11 Version 24H2 for ARM64-based Systems
Fixed versions10.0.26100.33650, 10.0.26200.9711, 10.0.26100.9711, 10.0.28000.3231
Vendor guidance

Install KB5126646. Install KB5127648. Install KB5127646.

CVE-2026-85910
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-85909
HighCVSS 5.5

Windows Universal Disk Format File System Driver (UDFS) Information Disclosure Vulnerability

Out-of-bounds read in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to disclose information locally.

Affected productsWindows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019, Windows Server 2019 (Server Core installation)
Fixed versions10.0.17763.9376, 10.0.20348.5761, 10.0.19044.7807, 10.0.19045.7807
Vendor guidance

Install KB5126651. Install KB5126655. Install KB5126657. Install KB5126646. Install KB5127648. Install KB5126653. Install KB5127646. Install KB5126868. Install KB5126835. Install KB5126836.

CVE-2026-85909
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-85908
HighCVSS 7.8

Windows Graphics Component Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.

Affected productsWindows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019, Windows Server 2019 (Server Core installation)
Fixed versions10.0.17763.9376, 10.0.20348.5761, 10.0.19044.7807, 10.0.19045.7807
Vendor guidance

Release Notes Install KB5126651. Install KB5126655. Install KB5126657. Install KB5126646. Install KB5127648. Install KB5126653. Install KB5127646. Install KB5126868. Install KB5126835. Install KB5126836.

CVE-2026-85908
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-85906
HighCVSS 7.8

Windows Direct Composition Elevation of Privilege Vulnerability

Use after free in Windows Direct Composition allows an authorized attacker to elevate privileges locally.

Affected productsWindows Server 2022, Windows Server 2022 (Server Core installation), Windows 10 Version 21H2 for 32-bit Systems, Windows 10 Version 21H2 for ARM64-based Systems
Fixed versions10.0.20348.5761, 10.0.19044.7807, 10.0.19045.7807, 10.0.26100.33650
Vendor guidance

Install KB5126655. Install KB5126657. Install KB5126646. Install KB5127648. Install KB5126653. Install KB5127646.

CVE-2026-85906
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-85905
HighCVSS 8.8

Windows UI Immersive Server API Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows UI Immersive Server allows an authorized attacker to elevate privileges locally.

Affected productsWindows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019, Windows Server 2019 (Server Core installation)
Fixed versions10.0.17763.9376, 10.0.20348.5761, 10.0.19044.7807, 10.0.19045.7807
Vendor guidance

Install KB5126651. Install KB5126655. Install KB5126657. Install KB5126646. Install KB5127648. Install KB5126653. Install KB5127646. Install KB5126868. Install KB5126835. Install KB5126836.

CVE-2026-85905
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-85904
HighCVSS 7.0

Windows Device Association Service Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Device Association Service allows an authorized attacker to elevate privileges locally.

Affected productsWindows 11 Version 26H2 for ARM64-based Systems, Windows 11 Version 26H2 for x64-based Systems, Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems
Fixed versions10.0.26300.9711, 10.0.17763.9376, 10.0.20348.5761, 10.0.19044.7807
Vendor guidance

Install KB5127648. Install KB5126651. Install KB5126655. Install KB5126657. Install KB5126646. Install KB5126653. Install KB5127646. Install KB5126868. Install KB5126835. Install KB5126836.

CVE-2026-85904
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-85903
HighCVSS 8.8

Windows Domain Name Service Remote Code Execution Vulnerability

Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a network.

Affected productsWindows 11 Version 26H2 for ARM64-based Systems, Windows 11 Version 26H2 for x64-based Systems, Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems
Fixed versions10.0.26300.9711, 10.0.17763.9376, 10.0.20348.5761, 10.0.19044.7807
Vendor guidance

Install KB5127648. Install KB5126651. Install KB5126655. Install KB5126657. Install KB5126646. Install KB5126653. Install KB5127646. Install KB5126868. Install KB5126835. Install KB5126836.

CVE-2026-85903
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-85902
HighCVSS 7.8

Windows Direct Composition Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Direct Composition allows an authorized attacker to elevate privileges locally.

Affected productsWindows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019, Windows Server 2019 (Server Core installation)
Fixed versions10.0.17763.9376, 10.0.20348.5761, 10.0.19044.7807, 10.0.19045.7807
Vendor guidance

Install KB5126651. Install KB5126655. Install KB5126657. Install KB5126646. Install KB5127648. Install KB5126653. Install KB5127646. Install KB5126868.

CVE-2026-85902
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-85901
HighCVSS 7.8

Windows Graphics Component Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.

Affected productsWindows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019, Windows Server 2019 (Server Core installation)
Fixed versions10.0.17763.9376, 10.0.20348.5761, 10.0.19044.7807, 10.0.19045.7807
Vendor guidance

Install KB5126651. Install KB5126655. Install KB5126657. Install KB5126646. Install KB5127648. Install KB5126653. Install KB5127646. Install KB5126868. Install KB5126835. Install KB5126836.

CVE-2026-85901
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-85888
HighCVSS 7.7

Microsoft SQL Server Information Disclosure Vulnerability

Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.

Affected productsMicrosoft SQL Server 2017 for x64-based Systems (GDR), Microsoft SQL Server 2019 for x64-based Systems (GDR), Microsoft SQL Server 2022 for x64-based Systems (GDR), Microsoft SQL Server 2017 for x64-based Systems (CU31)
Fixed versions14.0.2140.2, 15.0.2200.2, 16.0.1210.3, 14.0.3560.2
Vendor guidance

Install KB5128497. Install KB5128495. Install KB5128493. Install KB5128496. Install KB5128492. Install KB5128494. Install KB5126934. Install KB5126967.

CVE-2026-85888
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-85886
HighCVSS 8.5

Microsoft SQL Server Remote Code Execution Vulnerability

Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.

Affected productsMicrosoft SQL Server 2017 for x64-based Systems (CU31), Microsoft SQL Server 2025 for x64-based Systems (GDR), Microsoft SQL Server 2017 for x64-based Systems (GDR), Microsoft SQL Server 2019 for x64-based Systems (GDR)
Fixed versions14.0.3560.2, 17.0.1145.4, 14.0.2140.2, 15.0.2200.2
Vendor guidance

Install KB5128496. Install KB5128492. Install KB5128497. Install KB5128495. Install KB5126934. Install KB5126967. Install KB5128493. Install KB5128494.

CVE-2026-85886
Read the vendor advisory Watch this product
Before you act

Start with the vendor's bulletin.

We normalize the fields that vendors publish so you can search and compare advisories in one place. We do not replace the original bulletin or turn a product-name match into proof that a system is vulnerable.

Confirm the installed product and version, read the linked vendor guidance, and test the recommended update or mitigation through your normal change process.

How we check our sources