← Home
September 2026 Early Security Updates
Source: microsoft / 2026-Sep
— original advisory
Published: 2026-09-03
· Last updated: 2026-09-30
· Vendor severity: Critical
CVEs
| CVE | CVSS | CWE | Exploitation |
|---|
| CVE-2026-14957 |
7.5 |
CWE-617 |
Not observed in the wild |
| CVE-2026-18743 |
2.5 |
CWE-131 |
Not observed in the wild |
| CVE-2026-55951 |
Not yet scored |
CWE-770: Allocation of Resources Without Limits or Throttling |
Not observed in the wild |
| CVE-2026-56143 |
4.9 |
CWE-770: Allocation of Resources Without Limits or Throttling |
Not observed in the wild |
| CVE-2026-59696 |
Not yet scored |
CWE-1284 |
Not observed in the wild |
| CVE-2026-62906 |
7.4 |
CWE-943 |
Not observed in the wild |
| CVE-2026-62916 |
9.1 |
CWE-288 |
Not observed in the wild |
| CVE-2026-65818 |
8.5 |
CWE-918: Server-Side Request Forgery (SSRF) |
Not observed in the wild |
| CVE-2026-66357 |
Not yet scored |
CWE-444 |
Not observed in the wild |
| CVE-2026-66835 |
Not yet scored |
CWE-50 |
Not observed in the wild |
| CVE-2026-69664 |
Not yet scored |
CWE-772 |
Not observed in the wild |
| CVE-2026-69857 |
8.5 |
CWE-639 |
Not observed in the wild |
| CVE-2026-70178 |
8.5 |
CWE-862: Missing Authorization |
Not observed in the wild |
| CVE-2026-70352 |
10.0 |
CWE-306: Missing Authentication for Critical Function |
Not observed in the wild |
| CVE-2026-70409 |
Not yet scored |
CWE-1284 |
Not observed in the wild |
| CVE-2026-71380 |
Not yet scored |
CWE-772 |
Not observed in the wild |
| CVE-2026-71562 |
Not yet scored |
CWE-1284 |
Not observed in the wild |
| CVE-2026-72649 |
8.8 |
CWE-502: Deserialization of Untrusted Data |
Not observed in the wild |
| CVE-2026-73270 |
Not yet scored |
CWE-178 |
Not observed in the wild |
| CVE-2026-73276 |
Not yet scored |
CWE-444 |
Not observed in the wild |
| CVE-2026-73812 |
Not yet scored |
CWE-444 |
Not observed in the wild |
| CVE-2026-74835 |
Not yet scored |
CWE-770: Allocation of Resources Without Limits or Throttling |
Not observed in the wild |
| CVE-2026-74994 |
Not yet scored |
CWE-863: Incorrect Authorization |
Not observed in the wild |
| CVE-2026-75538 |
Not yet scored |
CWE-190: Integer Overflow or Wraparound |
Not observed in the wild |
| CVE-2026-78607 |
5.4 |
CWE-862: Missing Authorization |
Not observed in the wild |
| CVE-2026-80098 |
9.3 |
CWE-347 |
Not observed in the wild |
| CVE-2026-83711 |
10.0 |
CWE-639 |
Not observed in the wild |
| CVE-2026-83941 |
9.9 |
CWE-862: Missing Authorization |
Not observed in the wild |
| CVE-2026-84323 |
Not yet scored |
Not classified |
Not observed in the wild |
| CVE-2026-84324 |
Not yet scored |
Not classified |
Not observed in the wild |
| CVE-2026-84325 |
Not yet scored |
Not classified |
Not observed in the wild |
| CVE-2026-84326 |
Not yet scored |
Not classified |
Not observed in the wild |
| CVE-2026-84327 |
Not yet scored |
Not classified |
Not observed in the wild |
| CVE-2026-84328 |
Not yet scored |
Not classified |
Not observed in the wild |
| CVE-2026-84329 |
Not yet scored |
Not classified |
Not observed in the wild |
| CVE-2026-84331 |
Not yet scored |
Not classified |
Not observed in the wild |
| CVE-2026-84332 |
Not yet scored |
Not classified |
Not observed in the wild |
| CVE-2026-84334 |
Not yet scored |
Not classified |
Not observed in the wild |
| CVE-2026-84335 |
Not yet scored |
Not classified |
Not observed in the wild |
| CVE-2026-84347 |
Not yet scored |
Not classified |
Not observed in the wild |
| CVE-2026-84348 |
Not yet scored |
Not classified |
Not observed in the wild |
| CVE-2026-84349 |
Not yet scored |
Not classified |
Not observed in the wild |
| CVE-2026-84350 |
Not yet scored |
Not classified |
Not observed in the wild |
| CVE-2026-84351 |
Not yet scored |
Not classified |
Not observed in the wild |
| CVE-2026-84353 |
Not yet scored |
Not classified |
Not observed in the wild |
| CVE-2026-84354 |
Not yet scored |
Not classified |
Not observed in the wild |
| CVE-2026-84355 |
Not yet scored |
Not classified |
Not observed in the wild |
| CVE-2026-84356 |
Not yet scored |
Not classified |
Not observed in the wild |
| CVE-2026-84357 |
Not yet scored |
Not classified |
Not observed in the wild |
| CVE-2026-84358 |
Not yet scored |
Not classified |
Not observed in the wild |
| CVE-2026-84359 |
Not yet scored |
Not classified |
Not observed in the wild |